njrat | 511a0cdc61c338825efad96c877972f4095f0c1405c4c5fc89a1bf66a1a48331 | Triage

Sharing

General

Target

511a0cdc61c338825efad96c877972f4095f0c1405c4c5fc89a1bf66a1a48331N
Size

27KB
Sample

241110-r4xq4sskbk
MD5

9f73345df18a214447e4bc9a0ea55fb0
SHA1

26f74098682eebba20da366912d44548c2113c4a
SHA256

511a0cdc61c338825efad96c877972f4095f0c1405c4c5fc89a1bf66a1a48331
SHA512

1bf1ca9cc591af98e029ee3b9807812f3952f2baed9bf489da52c51fd834bbddaff048d09adf3d6c0785204be117b3db99aeede2d7b62eb7521c68b3e2088673
SSDEEP

384:gLRTAXeOGgkBANvcF8smWPpJRzMVAQk93vmhm7UMKmIEecKdbXTzm9bVhcakc6V1:+Z6CUNeeVA/vMHTi9bDk

Score

10^/10

njrat hacked discovery

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

child-tire.gl.at.ply.gg:57932

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Targets

- Target
  
  511a0cdc61c338825efad96c877972f4095f0c1405c4c5fc89a1bf66a1a48331N
- Size
  
  27KB
- MD5
  
  9f73345df18a214447e4bc9a0ea55fb0
- SHA1
  
  26f74098682eebba20da366912d44548c2113c4a
- SHA256
  
  511a0cdc61c338825efad96c877972f4095f0c1405c4c5fc89a1bf66a1a48331
- SHA512
  
  1bf1ca9cc591af98e029ee3b9807812f3952f2baed9bf489da52c51fd834bbddaff048d09adf3d6c0785204be117b3db99aeede2d7b62eb7521c68b3e2088673
- SSDEEP
  
  384:gLRTAXeOGgkBANvcF8smWPpJRzMVAQk93vmhm7UMKmIEecKdbXTzm9bVhcakc6V1:+Z6CUNeeVA/vMHTi9bDk
Score

7^/10

discovery
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2