njrat | 7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

New Client.exe

windows10-2004-x64

7

Sharing

General

Target

New Client.exe
Size

167KB
Sample

241222-axehhswkay
MD5

c05d3f2f9e97414951d9a850925aae47
SHA1

adf749dcdd4107fd1e9a4c235745e8dbd0c367c1
SHA256

7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7
SHA512

04c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212
SSDEEP

3072:VcMADoN36tnQviFCtABnKfWl9zqaF9bwYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:V9i9z/vM1/JdSI5eb

Score

10^/10

njrat hacked discovery persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

New Client.exe

Resource

win10v2004-20241007-en

discovery persistence

windows10-2004-x64

14 signatures

900 seconds

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:14324

Mutex

discord.exe

Attributes

reg_key
discord.exe
splitter
|Ghost|

Targets

- Target
  
  New Client.exe
- Size
  
  167KB
- MD5
  
  c05d3f2f9e97414951d9a850925aae47
- SHA1
  
  adf749dcdd4107fd1e9a4c235745e8dbd0c367c1
- SHA256
  
  7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7
- SHA512
  
  04c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212
- SSDEEP
  
  3072:VcMADoN36tnQviFCtABnKfWl9zqaF9bwYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:V9i9z/vM1/JdSI5eb
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.