njrat | 6cd803552c3fccea87f24655af28a08bef2593590c6d418f8e6157c50a4f3938 | Triage

Sharing

General

Target

Server.exe
Size

93KB
Sample

241216-nn9tysymez
MD5

4106c643751ca405526c35082b61e21e
SHA1

a00c03ab8b002b561489b2ef981a23136523949d
SHA256

6cd803552c3fccea87f24655af28a08bef2593590c6d418f8e6157c50a4f3938
SHA512

a780ed987ad64983c21a44a84285f1cd00d5e32449c85bdf1ffc7822424bec3c7bcf4823071268989a5a6f583d01e98a632a999eba0d8b613ffe8fc77419bbdb
SSDEEP

1536:JcwC+xhUa9urgOBPmNvM4jEwzGi1dDUD+gS:JcmUa9urgOkdGi1d6j

Score

10^/10

njrat fucked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

fucked

C2

hakim32.ddns.net:2000

november-knife.gl.at.ply.gg:31521

Mutex

b441dab2dad78af5af045a19f94e9c80

Attributes

reg_key
b441dab2dad78af5af045a19f94e9c80
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  4106c643751ca405526c35082b61e21e
- SHA1
  
  a00c03ab8b002b561489b2ef981a23136523949d
- SHA256
  
  6cd803552c3fccea87f24655af28a08bef2593590c6d418f8e6157c50a4f3938
- SHA512
  
  a780ed987ad64983c21a44a84285f1cd00d5e32449c85bdf1ffc7822424bec3c7bcf4823071268989a5a6f583d01e98a632a999eba0d8b613ffe8fc77419bbdb
- SSDEEP
  
  1536:JcwC+xhUa9urgOBPmNvM4jEwzGi1dDUD+gS:JcmUa9urgOkdGi1d6j
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation