njrat | d95dc5a6698064c53478a2bade1d6d3b1cbdb5de91e667e73ab34986904c795f | Triage

Sharing

General

Target

d95dc5a6698064c53478a2bade1d6d3b1cbdb5de91e667e73ab34986904c795fN
Size

93KB
Sample

241106-ab4waascnk
MD5

b66edb080bac929b36fd82c307258290
SHA1

c488f238a833d43ba13c936264f0818d63373af1
SHA256

d95dc5a6698064c53478a2bade1d6d3b1cbdb5de91e667e73ab34986904c795f
SHA512

b41f861cf8256d1c67b5e2f619309d16bcbb624c9456ff82dd0189498764c25b7f6f0feb2d358cd63334915a3a24243f70731520935477814b839a9fa9c30aef
SSDEEP

1536:6UxOx6baIa9RZj00ljEwzGi1dDyeDhgS:6UxbaIa93jNSi1d9e

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:1488

Mutex

3d044d54d6fe35afc690678f8def20e8

Attributes

reg_key
3d044d54d6fe35afc690678f8def20e8
splitter
|'|'|

Targets

- Target
  
  d95dc5a6698064c53478a2bade1d6d3b1cbdb5de91e667e73ab34986904c795fN
- Size
  
  93KB
- MD5
  
  b66edb080bac929b36fd82c307258290
- SHA1
  
  c488f238a833d43ba13c936264f0818d63373af1
- SHA256
  
  d95dc5a6698064c53478a2bade1d6d3b1cbdb5de91e667e73ab34986904c795f
- SHA512
  
  b41f861cf8256d1c67b5e2f619309d16bcbb624c9456ff82dd0189498764c25b7f6f0feb2d358cd63334915a3a24243f70731520935477814b839a9fa9c30aef
- SSDEEP
  
  1536:6UxOx6baIa9RZj00ljEwzGi1dDyeDhgS:6UxbaIa93jNSi1d9e
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation