njrat | 19961096c9ff8ff1f20c3ba9714dd24f2492dd812f8593628d0fc6a00c133534 | Triage

Sharing

General

Target

JaffaCakes118_6c376f803b656b4c5d3527ba1f08ad50
Size

237KB
Sample

250103-nbgbwatjbp
MD5

6c376f803b656b4c5d3527ba1f08ad50
SHA1

5a95177c489a2b7a598322c08fb2d32c3fd94e2d
SHA256

19961096c9ff8ff1f20c3ba9714dd24f2492dd812f8593628d0fc6a00c133534
SHA512

3856f20481d1712d4c79964979efb769d88b263bf8efd28e3af9300d8d7863c4af3f1b2d783531aa947b41c1b44c285f3e025c45158d2800d18dfda676b544a1
SSDEEP

6144:InpbIdO/QQLI2oscVS8Br9cOO0JCQiluxFiyfUsG4dO/QQL:I+d6QL+4d6Q

Score

10^/10

njrat discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  JaffaCakes118_6c376f803b656b4c5d3527ba1f08ad50
- Size
  
  237KB
- MD5
  
  6c376f803b656b4c5d3527ba1f08ad50
- SHA1
  
  5a95177c489a2b7a598322c08fb2d32c3fd94e2d
- SHA256
  
  19961096c9ff8ff1f20c3ba9714dd24f2492dd812f8593628d0fc6a00c133534
- SHA512
  
  3856f20481d1712d4c79964979efb769d88b263bf8efd28e3af9300d8d7863c4af3f1b2d783531aa947b41c1b44c285f3e025c45158d2800d18dfda676b544a1
- SSDEEP
  
  6144:InpbIdO/QQLI2oscVS8Br9cOO0JCQiluxFiyfUsG4dO/QQL:I+d6QL+4d6Q
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation