njrat | 7ebeecbc8be6ef0639cdfc58a6e7adb22786de3268efbc71a84e2407abf30c0e | Triage

Sharing

General

Target

Microsoft_Hardware_Launch.exe
Size

93KB
Sample

241216-g3rtcsxrax
MD5

7e9aea4310d362cc62c7eef48b9bea7d
SHA1

0d0f4ba4460f30731da5f5b7a2df5538fc39509c
SHA256

7ebeecbc8be6ef0639cdfc58a6e7adb22786de3268efbc71a84e2407abf30c0e
SHA512

7e4a2f2076adebf213e2d86f5e8924924db0f609cabd4e55a4707a293410cad83dd93c3c82a4e93fa9d580454e9e20549c621dbc3b7733081874b99ff747b415
SSDEEP

1536:15ngg1XvKE3IrXX3BujEwzGi1dDXDGgS:15hXvKE3Irn3BXi1dHr

Score

10^/10

njrat victam :d discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

VicTam :D

C2

hakim32.ddns.net:2000

micrsoft.con-ip.com:8888

Mutex

67ff3a880cd1a5cd235418c7516e5812

Attributes

reg_key
67ff3a880cd1a5cd235418c7516e5812
splitter
|'|'|

Targets

- Target
  
  Microsoft_Hardware_Launch.exe
- Size
  
  93KB
- MD5
  
  7e9aea4310d362cc62c7eef48b9bea7d
- SHA1
  
  0d0f4ba4460f30731da5f5b7a2df5538fc39509c
- SHA256
  
  7ebeecbc8be6ef0639cdfc58a6e7adb22786de3268efbc71a84e2407abf30c0e
- SHA512
  
  7e4a2f2076adebf213e2d86f5e8924924db0f609cabd4e55a4707a293410cad83dd93c3c82a4e93fa9d580454e9e20549c621dbc3b7733081874b99ff747b415
- SSDEEP
  
  1536:15ngg1XvKE3IrXX3BujEwzGi1dDXDGgS:15hXvKE3Irn3BXi1dHr
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation