njrat | 82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e | Triage

Sharing

General

Target

82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
Size

93KB
Sample

241231-gv5egsyjak
MD5

649ccc1f57bab5d308d0b6fdbcb163a9
SHA1

d975bb450229faa84814b91248ef63c6a522d3b2
SHA256

82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e
SHA512

6315458ecc6d116b52a0869d88e30c96d91cdd91d97c7039065a8b0d02ec8137826c1eea0db1cb6be702cdb5d87d65be8ac6b5a3f0de9da47eac848b82304c45
SSDEEP

768:0Y33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3zusN:rUxOx6baIa9RZj00ljEwzGi1dD2DFgSk

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:58905

Mutex

5aaa7064cdb598d29f999ea8c3e69c8d

Attributes

reg_key
5aaa7064cdb598d29f999ea8c3e69c8d
splitter
|'|'|

Targets

- Target
  
  82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
- Size
  
  93KB
- MD5
  
  649ccc1f57bab5d308d0b6fdbcb163a9
- SHA1
  
  d975bb450229faa84814b91248ef63c6a522d3b2
- SHA256
  
  82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e
- SHA512
  
  6315458ecc6d116b52a0869d88e30c96d91cdd91d97c7039065a8b0d02ec8137826c1eea0db1cb6be702cdb5d87d65be8ac6b5a3f0de9da47eac848b82304c45
- SSDEEP
  
  768:0Y33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3zusN:rUxOx6baIa9RZj00ljEwzGi1dD2DFgSk
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation