njrat | 0e2723dfbf1dc66b507178cc7c15690e48767d19f25280c4f3245b5a499a5c08 | Triage

Sharing

General

Target

0e2723dfbf1dc66b507178cc7c15690e48767d19f25280c4f3245b5a499a5c08N
Size

93KB
Sample

241102-tbgwasycng
MD5

f6b6d7c09ea3811f2934d6879b6c5bb0
SHA1

cf5895e2c63dfad06a23887b9e37f56ad62f685d
SHA256

0e2723dfbf1dc66b507178cc7c15690e48767d19f25280c4f3245b5a499a5c08
SHA512

22d53b78d8cd9050e1848937e686361a8bcb0e17a5fce573ff8c7da57a1518da1a1a663699f018ca6bdea220812056b9ef4c081ad770fd52dcf2e3f88e09dfaf
SSDEEP

768:+Y3CUnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3gsGD:0UxOx6baIa9ROj00ljEwzGi1dD4DPgS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

192.168.1.7:4444

Mutex

864d1e73cdcbca30122c85c00460e5e4

Attributes

reg_key
864d1e73cdcbca30122c85c00460e5e4
splitter
|'|'|

Targets

- Target
  
  0e2723dfbf1dc66b507178cc7c15690e48767d19f25280c4f3245b5a499a5c08N
- Size
  
  93KB
- MD5
  
  f6b6d7c09ea3811f2934d6879b6c5bb0
- SHA1
  
  cf5895e2c63dfad06a23887b9e37f56ad62f685d
- SHA256
  
  0e2723dfbf1dc66b507178cc7c15690e48767d19f25280c4f3245b5a499a5c08
- SHA512
  
  22d53b78d8cd9050e1848937e686361a8bcb0e17a5fce573ff8c7da57a1518da1a1a663699f018ca6bdea220812056b9ef4c081ad770fd52dcf2e3f88e09dfaf
- SSDEEP
  
  768:+Y3CUnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3gsGD:0UxOx6baIa9ROj00ljEwzGi1dD4DPgS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation