njrat | 772d76e5b9841deb1e5105bb7487e5a3289d8424fcb19e21d8c0929778ccfb60 | Triage

Sharing

General

Target

772d76e5b9841deb1e5105bb7487e5a3289d8424fcb19e21d8c0929778ccfb60.exe
Size

93KB
Sample

241207-hd87sa1jds
MD5

5838bbaae4c3d872b7c76e182241ff52
SHA1

7a63204bac1f6e97eb290c598bbc7e5df0bc3f14
SHA256

772d76e5b9841deb1e5105bb7487e5a3289d8424fcb19e21d8c0929778ccfb60
SHA512

47e55a171f77df940005749a32ae896671448b7e80312dd6d2bb7c2a91e986ec0e97b75a7ee52816840db22c24cc6710781fceb7b9f0613d5dc14bcb979ae462
SSDEEP

768:kY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsGG:7UxOx6baIa9RZj00ljEwzGi1dDXDdgS8

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

90cdc4299e3838b5249c33e1c7a2dd25

Attributes

reg_key
90cdc4299e3838b5249c33e1c7a2dd25
splitter
|'|'|

Targets

- Target
  
  772d76e5b9841deb1e5105bb7487e5a3289d8424fcb19e21d8c0929778ccfb60.exe
- Size
  
  93KB
- MD5
  
  5838bbaae4c3d872b7c76e182241ff52
- SHA1
  
  7a63204bac1f6e97eb290c598bbc7e5df0bc3f14
- SHA256
  
  772d76e5b9841deb1e5105bb7487e5a3289d8424fcb19e21d8c0929778ccfb60
- SHA512
  
  47e55a171f77df940005749a32ae896671448b7e80312dd6d2bb7c2a91e986ec0e97b75a7ee52816840db22c24cc6710781fceb7b9f0613d5dc14bcb979ae462
- SSDEEP
  
  768:kY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsGG:7UxOx6baIa9RZj00ljEwzGi1dDXDdgS8
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation