njrat | 68cc83fa2cf2a9f7edb864324073b9e8baebb0734cfd384cb1072631161c8937 | Triage

Sharing

General

Target

faas.exe
Size

93KB
Sample

250109-2f2ehatjct
MD5

f3d3cdb5f5ba00023ca78a531158fab0
SHA1

455e6b654ccf39ea38863d1e620ccc020aa864ff
SHA256

68cc83fa2cf2a9f7edb864324073b9e8baebb0734cfd384cb1072631161c8937
SHA512

30ae0bd77d0abef23e476f12a00375d34bef6cd1a9fc785f2aadffa7b5dda0d3603c73ba962d7f67b97949eeb6ff9db92e199540b04b23a588e479209d72d59c
SSDEEP

768:UY3dUfnWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3ssGdpngM:BU/WhIUKcuOJhPhBjEwzGi1dDkDngS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:4444

Mutex

51820cb0a31bd77e1a3fe5a2fd3b47f2

Attributes

reg_key
51820cb0a31bd77e1a3fe5a2fd3b47f2
splitter
|'|'|

Targets

- Target
  
  faas.exe
- Size
  
  93KB
- MD5
  
  f3d3cdb5f5ba00023ca78a531158fab0
- SHA1
  
  455e6b654ccf39ea38863d1e620ccc020aa864ff
- SHA256
  
  68cc83fa2cf2a9f7edb864324073b9e8baebb0734cfd384cb1072631161c8937
- SHA512
  
  30ae0bd77d0abef23e476f12a00375d34bef6cd1a9fc785f2aadffa7b5dda0d3603c73ba962d7f67b97949eeb6ff9db92e199540b04b23a588e479209d72d59c
- SSDEEP
  
  768:UY3dUfnWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3ssGdpngM:BU/WhIUKcuOJhPhBjEwzGi1dDkDngS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation

behavioral3

discoveryevasionpersistenceprivilege_escalation