njrat | 6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529 | Triage

Sharing

General

Target

6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529.exe
Size

235KB
Sample

241217-dqrfaaymey
MD5

6932b7496923927a168f33e9c584df04
SHA1

12efc094c2b3e1f1da263751baeb918e892faf2c
SHA256

6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529
SHA512

c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77
SSDEEP

1536:IUr5W+qXYW+g+gRJNSwEqU0K2p5Adc6i6UxUFC5AFN:IUr0+hI+yJgbqAdo6UxUFQQ

Score

10^/10

njrat client discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Client

C2

127.0.0.1:2022

Mutex

220fe34d4dcc4a99fe35d2fb7ce78939

Attributes

reg_key
220fe34d4dcc4a99fe35d2fb7ce78939
splitter
|'|'|

Targets

- Target
  
  6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529.exe
- Size
  
  235KB
- MD5
  
  6932b7496923927a168f33e9c584df04
- SHA1
  
  12efc094c2b3e1f1da263751baeb918e892faf2c
- SHA256
  
  6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529
- SHA512
  
  c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77
- SSDEEP
  
  1536:IUr5W+qXYW+g+gRJNSwEqU0K2p5Adc6i6UxUFC5AFN:IUr0+hI+yJgbqAdo6UxUFQQ
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation