njrat | 2e2c89e9626c90c420fb99b5fcfb0f980b9312afc5d0cf15c906ce87249da5ab | Triage

Sharing

General

Target

JaffaCakes118_6a6e6232b2a58d4d50f10251df3b6d80
Size

30KB
Sample

250103-fvwxns1jdw
MD5

6a6e6232b2a58d4d50f10251df3b6d80
SHA1

fe079365e9b19dc816b3d0629c5529abe759c7ba
SHA256

2e2c89e9626c90c420fb99b5fcfb0f980b9312afc5d0cf15c906ce87249da5ab
SHA512

a00e0d44ca4bb51cf0923120e5bd185031e3a578dd35e88a04703d268727ec1740a7d15d5d2b1aa7eb5543a8a7a74a546b69a0ac4acad21d0bd8ae5d9c7d6a10
SSDEEP

384:rcX42FYwYaLVd46WFG3KGheaeBySoxww8gJpCrgliE27F6nMMl0xqbiX+lm/4xYd:LsVd4RGhbePoCw8NrUi+nu0bJSjpvc

Score

10^/10

njrat discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  JaffaCakes118_6a6e6232b2a58d4d50f10251df3b6d80
- Size
  
  30KB
- MD5
  
  6a6e6232b2a58d4d50f10251df3b6d80
- SHA1
  
  fe079365e9b19dc816b3d0629c5529abe759c7ba
- SHA256
  
  2e2c89e9626c90c420fb99b5fcfb0f980b9312afc5d0cf15c906ce87249da5ab
- SHA512
  
  a00e0d44ca4bb51cf0923120e5bd185031e3a578dd35e88a04703d268727ec1740a7d15d5d2b1aa7eb5543a8a7a74a546b69a0ac4acad21d0bd8ae5d9c7d6a10
- SSDEEP
  
  384:rcX42FYwYaLVd46WFG3KGheaeBySoxww8gJpCrgliE27F6nMMl0xqbiX+lm/4xYd:LsVd4RGhbePoCw8NrUi+nu0bJSjpvc
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation