njrat | 977545a82597579ca14991cc2117466b4a8a8015123abb531589161c0f5b45f4 | Triage

Sharing

General

Target

977545a82597579ca14991cc2117466b4a8a8015123abb531589161c0f5b45f4
Size

65KB
Sample

250108-xk173s1paj
MD5

83e74bf86e47d5c6935dd34a30359313
SHA1

995931a943252008d8ac908802d428222f97629a
SHA256

977545a82597579ca14991cc2117466b4a8a8015123abb531589161c0f5b45f4
SHA512

de01c44c81476f7ee55b30612db6f4816b291a9916f315db8ac5a63b315989fd0796fba045434a3d10458018d06ecbebbd595b37879225faddc596aaa2a690ed
SSDEEP

1536:eqM776oN36tMQviFw1NXkgBnvbNfLteF3nLrB9z3ndaF9biS9vM:ex776oN36tMQviFC5NBnRfWl9ztaF9bK

Score

10^/10

njrat exloeder discovery persistence

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

ExLoeder

C2

127.0.0.1:3162

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
|Ghost|

Targets

- Target
  
  977545a82597579ca14991cc2117466b4a8a8015123abb531589161c0f5b45f4
- Size
  
  65KB
- MD5
  
  83e74bf86e47d5c6935dd34a30359313
- SHA1
  
  995931a943252008d8ac908802d428222f97629a
- SHA256
  
  977545a82597579ca14991cc2117466b4a8a8015123abb531589161c0f5b45f4
- SHA512
  
  de01c44c81476f7ee55b30612db6f4816b291a9916f315db8ac5a63b315989fd0796fba045434a3d10458018d06ecbebbd595b37879225faddc596aaa2a690ed
- SSDEEP
  
  1536:eqM776oN36tMQviFw1NXkgBnvbNfLteF3nLrB9z3ndaF9biS9vM:ex776oN36tMQviFC5NBnRfWl9ztaF9bK
Score

7^/10

discovery persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence