njrat | b9a684c4ae342391adaa28eec05717fd4ea98ec68c44e45d436fb0cf8490d8b4 | Triage

Sharing

General

Target

Server.exe
Size

37KB
Sample

250118-wjhhxazkey
MD5

cad430e0dd18698b04eb00545e6538aa
SHA1

6e9d31505bed490a499d25cac0d129a9d0e631bf
SHA256

b9a684c4ae342391adaa28eec05717fd4ea98ec68c44e45d436fb0cf8490d8b4
SHA512

67e073ba2a098e2857ef85fab0ba752a99adf1c94d1f7f86d16bc586cc563de981733c3f16eadd0b8e1efbe53634017f36d0df7093599cf974518224443bec1f
SSDEEP

384:e36Nb7LsikZ9zNf/1uyU71evdjsOaP4rAF+rMRTyN/0L+EcoinblneHQM3epzXhW:DNf4l1lU71e9FagrM+rMRa8Nu+Ft

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

black-associates.gl.at.ply.gg:40091

Mutex

37a1466afd082705c8e8913a15b7adae

Attributes

reg_key
37a1466afd082705c8e8913a15b7adae
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  cad430e0dd18698b04eb00545e6538aa
- SHA1
  
  6e9d31505bed490a499d25cac0d129a9d0e631bf
- SHA256
  
  b9a684c4ae342391adaa28eec05717fd4ea98ec68c44e45d436fb0cf8490d8b4
- SHA512
  
  67e073ba2a098e2857ef85fab0ba752a99adf1c94d1f7f86d16bc586cc563de981733c3f16eadd0b8e1efbe53634017f36d0df7093599cf974518224443bec1f
- SSDEEP
  
  384:e36Nb7LsikZ9zNf/1uyU71evdjsOaP4rAF+rMRTyN/0L+EcoinblneHQM3epzXhW:DNf4l1lU71e9FagrM+rMRa8Nu+Ft
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation