njrat | 56b3ddac0c8b5d6e4e31c452a200baf843acd84d174d05db0317f28f79b4f9cd | Triage

Sharing

General

Target

0b06ffc35e57fa882d381e2516890367.exe
Size

93KB
Sample

250107-2wnhkssndy
MD5

0b06ffc35e57fa882d381e2516890367
SHA1

5f1aae9f6368528637e5ff05562366b306456d80
SHA256

56b3ddac0c8b5d6e4e31c452a200baf843acd84d174d05db0317f28f79b4f9cd
SHA512

cf386bd0b9fa0b2358dfa9c9ca8c5d12142f3aefa4b461ffbe0d12f1ffc1be6d6581ef7a917b4e456368dba7e9c53ed5bcc13fd06893c49882f7fe23d4c0959f
SSDEEP

1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

77.90.22.45:3333

Mutex

7d8b54f61658224964f27b9b12cf7d70

Attributes

reg_key
7d8b54f61658224964f27b9b12cf7d70
splitter
|'|'|

Targets

- Target
  
  0b06ffc35e57fa882d381e2516890367.exe
- Size
  
  93KB
- MD5
  
  0b06ffc35e57fa882d381e2516890367
- SHA1
  
  5f1aae9f6368528637e5ff05562366b306456d80
- SHA256
  
  56b3ddac0c8b5d6e4e31c452a200baf843acd84d174d05db0317f28f79b4f9cd
- SHA512
  
  cf386bd0b9fa0b2358dfa9c9ca8c5d12142f3aefa4b461ffbe0d12f1ffc1be6d6581ef7a917b4e456368dba7e9c53ed5bcc13fd06893c49882f7fe23d4c0959f
- SSDEEP
  
  1536:EgxOx6baIa9RZj00ljEwzGi1dDzDAegS:EgxbaIa93jNSi1dzAD
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation