njrat | 72efe630f7cd86059f73b1896fd29450ebda8807cd5c008900a9b06eea81c9e5 | Triage

Sharing

General

Target

72efe630f7cd86059f73b1896fd29450ebda8807cd5c008900a9b06eea81c9e5N.exe
Size

37KB
Sample

241123-mew13asrby
MD5

df33e91108ba71303c82d054e4d62880
SHA1

6b94f7beafc29baaa18d4cd6b5d098c535608fe6
SHA256

72efe630f7cd86059f73b1896fd29450ebda8807cd5c008900a9b06eea81c9e5
SHA512

6c8e1caf785c2518e67506fcc01ee20a524ec41838bcc272a708e9d0a2ab1d1a6050c3a68a0301c79e11e0d13b5f3345c9bb9697fe65f4e3ed3385dc56cceb68
SSDEEP

384:W0L8CT0i9NdTe/kCOyU7NuvLmDPM+7rAF+rMRTyN/0L+EcoinblneHQM3epzX6Nl:FLhT1CFU7NuKbMgrM+rMRa8Nuw1t

Score

10^/10

njrat user discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

User

C2

45.138.99.2:2347

Mutex

60450de78f31562453a82dbb1f442656

Attributes

reg_key
60450de78f31562453a82dbb1f442656
splitter
|'|'|

Targets

- Target
  
  72efe630f7cd86059f73b1896fd29450ebda8807cd5c008900a9b06eea81c9e5N.exe
- Size
  
  37KB
- MD5
  
  df33e91108ba71303c82d054e4d62880
- SHA1
  
  6b94f7beafc29baaa18d4cd6b5d098c535608fe6
- SHA256
  
  72efe630f7cd86059f73b1896fd29450ebda8807cd5c008900a9b06eea81c9e5
- SHA512
  
  6c8e1caf785c2518e67506fcc01ee20a524ec41838bcc272a708e9d0a2ab1d1a6050c3a68a0301c79e11e0d13b5f3345c9bb9697fe65f4e3ed3385dc56cceb68
- SSDEEP
  
  384:W0L8CT0i9NdTe/kCOyU7NuvLmDPM+7rAF+rMRTyN/0L+EcoinblneHQM3epzX6Nl:FLhT1CFU7NuKbMgrM+rMRa8Nuw1t
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation