njrat | 8d1328f74221f24c75032458e98da6137b9f1bdf43fe05785e39e121c8631d8d | Triage

Sharing

General

Target

8d1328f74221f24c75032458e98da6137b9f1bdf43fe05785e39e121c8631d8d.exe
Size

93KB
Sample

241120-zwxp5sxqer
MD5

1a3e34c32e36ecfa083b8eabb05bfd3d
SHA1

22029557eebefe85924ca88507c33aad557ffca3
SHA256

8d1328f74221f24c75032458e98da6137b9f1bdf43fe05785e39e121c8631d8d
SHA512

80f6e10973321d0c3b713e938c08715caeb76c252197bab424ccfc9d1f67143a6e1bd3597cf692da35fd7729180d746d5514d2bedd7f6a8acc8f520f995d91d4
SSDEEP

768:KY3OUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3YsGdpYgF:0U5WhIUKcuOJ2PhBjEwzGi1dDwDYgS0

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

0.tcp.ngrok.io:10571

Mutex

0361e35ad6f12355faea07e90becd797

Attributes

reg_key
0361e35ad6f12355faea07e90becd797
splitter
|'|'|

Targets

- Target
  
  8d1328f74221f24c75032458e98da6137b9f1bdf43fe05785e39e121c8631d8d.exe
- Size
  
  93KB
- MD5
  
  1a3e34c32e36ecfa083b8eabb05bfd3d
- SHA1
  
  22029557eebefe85924ca88507c33aad557ffca3
- SHA256
  
  8d1328f74221f24c75032458e98da6137b9f1bdf43fe05785e39e121c8631d8d
- SHA512
  
  80f6e10973321d0c3b713e938c08715caeb76c252197bab424ccfc9d1f67143a6e1bd3597cf692da35fd7729180d746d5514d2bedd7f6a8acc8f520f995d91d4
- SSDEEP
  
  768:KY3OUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3YsGdpYgF:0U5WhIUKcuOJ2PhBjEwzGi1dDwDYgS0
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation