njrat | 26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc | Triage

Sharing

General

Target

26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc.exe
Size

27KB
Sample

241214-djg82atjbw
MD5

feaca07182c6be327551ba4402a338c7
SHA1

5c699eb735def4473b9b02de282ccead84af1061
SHA256

26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc
SHA512

0ada77bc81af9b5d865f06cd6f91457281bdebbf07183367b7d3d0bd598ad7d3ce081b0d1f0741efbbe6c3839620bb17b637ff9727cb3440d5b96b3eab70dda1
SSDEEP

384:FLd6XW/7mgEpgHs+k0sePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcak63r6s:FQXsqctZ2A/vMHTi9bD

Score

10^/10

njrat hacked discovery

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

heo.ddns.net:5552

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Targets

- Target
  
  26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc.exe
- Size
  
  27KB
- MD5
  
  feaca07182c6be327551ba4402a338c7
- SHA1
  
  5c699eb735def4473b9b02de282ccead84af1061
- SHA256
  
  26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc
- SHA512
  
  0ada77bc81af9b5d865f06cd6f91457281bdebbf07183367b7d3d0bd598ad7d3ce081b0d1f0741efbbe6c3839620bb17b637ff9727cb3440d5b96b3eab70dda1
- SSDEEP
  
  384:FLd6XW/7mgEpgHs+k0sePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcak63r6s:FQXsqctZ2A/vMHTi9bD
Score

7^/10

discovery
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2