njrat | f1cbfec6af1baacb859f1b15b455278f23cf50ff81a45f0f0282f67495f98067 | Triage

Sharing

General

Target

f1cbfec6af1baacb859f1b15b455278f23cf50ff81a45f0f0282f67495f98067
Size

37KB
Sample

241116-ygyhfswqdq
MD5

ab3cbda7a67d1d197ef5bad8da198ac0
SHA1

563bfa62b96a2e8e9aef2a413c794589568457ad
SHA256

f1cbfec6af1baacb859f1b15b455278f23cf50ff81a45f0f0282f67495f98067
SHA512

4bf7090e56c00b4cba798feb9ab2f826b9970131cc6433dc785528500a1d11a5a3f4c8a7f87bc56290d2fddc546bf5ef28ef11cc4423e06f9d868e2c00a8a830
SSDEEP

384:H+mBkiy1nDNGRn5IyUv8IR/hh0/aKVEcrAF+rMRTyN/0L+EcoinblneHQM3epzXT:ed5M5jUvxRoCKWcrM+rMRa8Nu9Rt

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

asdaryder.duckdns.org:5552

Mutex

52b28bbc708fe48f8f67e791d73457ac

Attributes

reg_key
52b28bbc708fe48f8f67e791d73457ac
splitter
|'|'|

Targets

- Target
  
  f1cbfec6af1baacb859f1b15b455278f23cf50ff81a45f0f0282f67495f98067
- Size
  
  37KB
- MD5
  
  ab3cbda7a67d1d197ef5bad8da198ac0
- SHA1
  
  563bfa62b96a2e8e9aef2a413c794589568457ad
- SHA256
  
  f1cbfec6af1baacb859f1b15b455278f23cf50ff81a45f0f0282f67495f98067
- SHA512
  
  4bf7090e56c00b4cba798feb9ab2f826b9970131cc6433dc785528500a1d11a5a3f4c8a7f87bc56290d2fddc546bf5ef28ef11cc4423e06f9d868e2c00a8a830
- SSDEEP
  
  384:H+mBkiy1nDNGRn5IyUv8IR/hh0/aKVEcrAF+rMRTyN/0L+EcoinblneHQM3epzXT:ed5M5jUvxRoCKWcrM+rMRa8Nu9Rt
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation