njrat | 3324e0b42bb2f59c605cdab74271e0c3b63a45786d1941d92b3b7abb6946a0e4 | Triage

Sharing

General

Target

JaffaCakes118_a82da1bff532a65cd40a98f551263363
Size

93KB
Sample

250108-ybp9wszpf1
MD5

a82da1bff532a65cd40a98f551263363
SHA1

7e48a49fdbd41965a5cab4bb848e59d3cda8b5f7
SHA256

3324e0b42bb2f59c605cdab74271e0c3b63a45786d1941d92b3b7abb6946a0e4
SHA512

7cbdcb64920a2a7eb87369a442620b05e2ea3914a64d62051b011b7b3d6e84a2197395660df47f3d2774b3886b0874c4d7b73218c7d3a644b6127ac83924e4a9
SSDEEP

768:KY3OUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3YsGdpYgM:0U5WhIUKcuOJ2PhBjEwzGi1dDwDYgS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

0.tcp.ngrok.io:10571

Mutex

0361e35ad6f12355faea07e90becd797

Attributes

reg_key
0361e35ad6f12355faea07e90becd797
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_a82da1bff532a65cd40a98f551263363
- Size
  
  93KB
- MD5
  
  a82da1bff532a65cd40a98f551263363
- SHA1
  
  7e48a49fdbd41965a5cab4bb848e59d3cda8b5f7
- SHA256
  
  3324e0b42bb2f59c605cdab74271e0c3b63a45786d1941d92b3b7abb6946a0e4
- SHA512
  
  7cbdcb64920a2a7eb87369a442620b05e2ea3914a64d62051b011b7b3d6e84a2197395660df47f3d2774b3886b0874c4d7b73218c7d3a644b6127ac83924e4a9
- SSDEEP
  
  768:KY3OUfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3YsGdpYgM:0U5WhIUKcuOJ2PhBjEwzGi1dDwDYgS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation