Overview

overview

10

Static

static

10

NjRat. 0.7D.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NjRat. 0.7D.exe

  • Size

    93KB

  • Sample

    250122-cdk73askax

  • MD5

    efd0042a248d7dca9967341071383a04

  • SHA1

    b3084a67d98436d0dd0d4b3b7a553a8613d2f6ce

  • SHA256

    70fb510737bd37ba1fb52030168ac8ff45aedce4c0cf3694df1ac06d47ff026a

  • SHA512

    f2a5aab5324d66b517e290d2cad99f02098c5f47d349ffd552db96d061e7fc0fba3c71bd04ff6b66a0cc22c29056f3eb071f5b4b0e7683be8ac2889edb295be4

  • SSDEEP

    768:BY3aCG4tCTpPchQRza90g5rxPXijj2TAuC4qu2XxrjEtCdnl2pi1Rz4Rk3+sGdpg:VCGKC9dzaGwrVJOzjEwzGi1dD6DGgS

Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552
Mutex

4c0314117e151252d905b21958b73e2c

Attributes
  • reg_key

    4c0314117e151252d905b21958b73e2c

  • splitter

    |'|'|

Targets

    • Target

      NjRat. 0.7D.exe

    • Size

      93KB

    • MD5

      efd0042a248d7dca9967341071383a04

    • SHA1

      b3084a67d98436d0dd0d4b3b7a553a8613d2f6ce

    • SHA256

      70fb510737bd37ba1fb52030168ac8ff45aedce4c0cf3694df1ac06d47ff026a

    • SHA512

      f2a5aab5324d66b517e290d2cad99f02098c5f47d349ffd552db96d061e7fc0fba3c71bd04ff6b66a0cc22c29056f3eb071f5b4b0e7683be8ac2889edb295be4

    • SSDEEP

      768:BY3aCG4tCTpPchQRza90g5rxPXijj2TAuC4qu2XxrjEtCdnl2pi1Rz4Rk3+sGdpg:VCGKC9dzaGwrVJOzjEwzGi1dD6DGgS

    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Disables Task Manager via registry modification

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • Deletes itself

    • Executes dropped EXE

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks