njrat | 924b6c916dd2667555c4d3076750c06f38a4b295972684aed2d82d93d53b0277 | Triage

Sharing

General

Target

924b6c916dd2667555c4d3076750c06f38a4b295972684aed2d82d93d53b0277
Size

93KB
Sample

241101-y7vt9atjey
MD5

9da5a2d7e5dc56547b740fdcc9c135ce
SHA1

e203e130ff8e38e2108d9a362d3ac82b39102ba3
SHA256

924b6c916dd2667555c4d3076750c06f38a4b295972684aed2d82d93d53b0277
SHA512

8ce0f84c24c2bc54ce5d2b4e70f88dc68b1be67b83c0670044f25e3881f2e3333737fd5cc51f120236f96ec7c98330f334028174549305981ce1d307d1b25efb
SSDEEP

768:OY3elnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3isGW:AlxOx6baIa9RZj00ljEwzGi1dD+DIgS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

e851696be66464b14807383fe18b6d74

Attributes

reg_key
e851696be66464b14807383fe18b6d74
splitter
|'|'|

Targets

- Target
  
  924b6c916dd2667555c4d3076750c06f38a4b295972684aed2d82d93d53b0277
- Size
  
  93KB
- MD5
  
  9da5a2d7e5dc56547b740fdcc9c135ce
- SHA1
  
  e203e130ff8e38e2108d9a362d3ac82b39102ba3
- SHA256
  
  924b6c916dd2667555c4d3076750c06f38a4b295972684aed2d82d93d53b0277
- SHA512
  
  8ce0f84c24c2bc54ce5d2b4e70f88dc68b1be67b83c0670044f25e3881f2e3333737fd5cc51f120236f96ec7c98330f334028174549305981ce1d307d1b25efb
- SSDEEP
  
  768:OY3elnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3isGW:AlxOx6baIa9RZj00ljEwzGi1dD+DIgS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation