njrat | e19b568dd059c6eeeced41f0a6fa07cfe5aa65c4af4c87299e63d4ba3a74b930 | Triage

Sharing

General

Target

Server.exe
Size

37KB
Sample

241215-npgjssvkfk
MD5

eaca275c90ac7507cd354e17d74d7561
SHA1

22f5abc3e8151ede9fc18c93893f1f33cf892123
SHA256

e19b568dd059c6eeeced41f0a6fa07cfe5aa65c4af4c87299e63d4ba3a74b930
SHA512

5132c06c79b43866f9ba0593c81da9d7d01a676b4e8162c4d64114b0b51b4d2e46651ab3859d6272320f71b3dece581a6d6068e16fc183073b1dc66ffd23afcb
SSDEEP

384:1izZxj6ic7ri5Z7JAyk/Y4IvDfZeKQV3rAF+rMRTyN/0L+EcoinblneHQM3epzXt:UznHJ7k/Y4IDZbQNrM+rMRa8NujJt

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

carolina-oxide.gl.at.ply.gg:27437

Mutex

8c2c88ed60c046b6047f59276746c8dd

Attributes

reg_key
8c2c88ed60c046b6047f59276746c8dd
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  eaca275c90ac7507cd354e17d74d7561
- SHA1
  
  22f5abc3e8151ede9fc18c93893f1f33cf892123
- SHA256
  
  e19b568dd059c6eeeced41f0a6fa07cfe5aa65c4af4c87299e63d4ba3a74b930
- SHA512
  
  5132c06c79b43866f9ba0593c81da9d7d01a676b4e8162c4d64114b0b51b4d2e46651ab3859d6272320f71b3dece581a6d6068e16fc183073b1dc66ffd23afcb
- SSDEEP
  
  384:1izZxj6ic7ri5Z7JAyk/Y4IvDfZeKQV3rAF+rMRTyN/0L+EcoinblneHQM3epzXt:UznHJ7k/Y4IDZbQNrM+rMRa8NujJt
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation