njrat | 6440a187050df238f26f7dc23783ae804e30510fc7811b8523d03bf763d0bf25 | Triage

Sharing

General

Target

6440a187050df238f26f7dc23783ae804e30510fc7811b8523d03bf763d0bf25N.exe
Size

104KB
Sample

241124-qswh8sxrgr
MD5

2d08f69e4af0382edcd40bcb8cac7780
SHA1

089c3ad6c8b40e8e6722bb3144a2de206bb498ec
SHA256

6440a187050df238f26f7dc23783ae804e30510fc7811b8523d03bf763d0bf25
SHA512

c8b10b595bed1aec636fe9e0613c7b3bf264e3be8f7b7efcc63a62cb40dbe705150ac7c8ddbcba4186c877363ff2c3cecb39595cd0e7058218ae081ddc145e29
SSDEEP

1536:6aUwC+xhUa9urgOBPmNvM4jEwzGi1dDCDSgS:6aUmUa9urgOkdGi1dk3

Score

10^/10

njrat sync discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

sync

C2

hakim32.ddns.net:2000

bolbol555.zapto.org:1177

Mutex

ff89deb872901880bdcf1e599c2fc109

Attributes

reg_key
ff89deb872901880bdcf1e599c2fc109
splitter
|'|'|

Targets

- Target
  
  6440a187050df238f26f7dc23783ae804e30510fc7811b8523d03bf763d0bf25N.exe
- Size
  
  104KB
- MD5
  
  2d08f69e4af0382edcd40bcb8cac7780
- SHA1
  
  089c3ad6c8b40e8e6722bb3144a2de206bb498ec
- SHA256
  
  6440a187050df238f26f7dc23783ae804e30510fc7811b8523d03bf763d0bf25
- SHA512
  
  c8b10b595bed1aec636fe9e0613c7b3bf264e3be8f7b7efcc63a62cb40dbe705150ac7c8ddbcba4186c877363ff2c3cecb39595cd0e7058218ae081ddc145e29
- SSDEEP
  
  1536:6aUwC+xhUa9urgOBPmNvM4jEwzGi1dDCDSgS:6aUmUa9urgOkdGi1dk3
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation