njrat | 8fc655b971d396bf8941ce18b6ff173dc072256d07a0ef14dba785eecee64b72 | Triage

Sharing

General

Target

8fc655b971d396bf8941ce18b6ff173dc072256d07a0ef14dba785eecee64b72N.exe
Size

93KB
Sample

250101-sm3rgazkfz
MD5

a09a9e94e515239defe70dec2e19c430
SHA1

d44fca451f1168ac2a227301c43df1c709f5657c
SHA256

8fc655b971d396bf8941ce18b6ff173dc072256d07a0ef14dba785eecee64b72
SHA512

48bd40774d6076e0e496527261ebabd08029f7ef642f5f59fea25659219ac43aee8045b3bda18f239a2fc7851db2bcc87215e5f3e9db19a41ceae3ce434ce484
SSDEEP

1536:iUrnEoSnsqS5ut/YMR8SjEwzGi1dDvDJgS:iU3SnsqS5uVYM+7i1dHG

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:4444

Mutex

e5bef73e53e8a9ca1ae2681b9a60d3a3

Attributes

reg_key
e5bef73e53e8a9ca1ae2681b9a60d3a3
splitter
|'|'|

Targets

- Target
  
  8fc655b971d396bf8941ce18b6ff173dc072256d07a0ef14dba785eecee64b72N.exe
- Size
  
  93KB
- MD5
  
  a09a9e94e515239defe70dec2e19c430
- SHA1
  
  d44fca451f1168ac2a227301c43df1c709f5657c
- SHA256
  
  8fc655b971d396bf8941ce18b6ff173dc072256d07a0ef14dba785eecee64b72
- SHA512
  
  48bd40774d6076e0e496527261ebabd08029f7ef642f5f59fea25659219ac43aee8045b3bda18f239a2fc7851db2bcc87215e5f3e9db19a41ceae3ce434ce484
- SSDEEP
  
  1536:iUrnEoSnsqS5ut/YMR8SjEwzGi1dDvDJgS:iU3SnsqS5uVYM+7i1dHG
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation