njrat | 97843ef49f6e8728ab4fdc104f30ff0d29597c900dd3d886bb94acc1a8346b04 | Triage

Sharing

General

Target

97843ef49f6e8728ab4fdc104f30ff0d29597c900dd3d886bb94acc1a8346b04.exe
Size

237KB
Sample

250108-mn2b5symgl
MD5

baba527768efa9d26309adb4eca0689b
SHA1

f78db369cc5ecad73ebd7c23757ca0ee49123d5d
SHA256

97843ef49f6e8728ab4fdc104f30ff0d29597c900dd3d886bb94acc1a8346b04
SHA512

52ab08ffca92ba8ec8fc70af6c50a2bf69ec56cea3310d9158a164c03937ee36243682b3701ec399d52538283c0ed7f1c15d3528b749cea85bd1be3736d6ed4e
SSDEEP

6144:InpbIdO/QQLI2oscVS8Br9cOO0JCQiluxFiyfUsG4dO/QQLj:I+d6QL+4d6Qg

Score

10^/10

njrat discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  97843ef49f6e8728ab4fdc104f30ff0d29597c900dd3d886bb94acc1a8346b04.exe
- Size
  
  237KB
- MD5
  
  baba527768efa9d26309adb4eca0689b
- SHA1
  
  f78db369cc5ecad73ebd7c23757ca0ee49123d5d
- SHA256
  
  97843ef49f6e8728ab4fdc104f30ff0d29597c900dd3d886bb94acc1a8346b04
- SHA512
  
  52ab08ffca92ba8ec8fc70af6c50a2bf69ec56cea3310d9158a164c03937ee36243682b3701ec399d52538283c0ed7f1c15d3528b749cea85bd1be3736d6ed4e
- SSDEEP
  
  6144:InpbIdO/QQLI2oscVS8Br9cOO0JCQiluxFiyfUsG4dO/QQLj:I+d6QL+4d6Qg
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation