njrat | 4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d | Triage

Sharing

General

Target

4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d
Size

93KB
Sample

250214-2zqr4s1laz
MD5

9c58f76efce10297cfe0025e9fa379b9
SHA1

a8cc3aa5cd30dc6471d965248ebc9e99e38c4013
SHA256

4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d
SHA512

05f626ec4752e503c19139c20d275f16621e91d7d7383975a2b7ed91622df384f8376b04ce0dca79177da87b40f225a9f31a051b29bb1474585dd2d01b837c81
SSDEEP

768:kY3zgnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3bsGn:3gxOx6baIa9ROj00ljEwzGi1dDnDrgS

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

25210401edf20bebda770f9604a6b3ec

Attributes

reg_key
25210401edf20bebda770f9604a6b3ec
splitter
|'|'|

Targets

- Target
  
  4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d
- Size
  
  93KB
- MD5
  
  9c58f76efce10297cfe0025e9fa379b9
- SHA1
  
  a8cc3aa5cd30dc6471d965248ebc9e99e38c4013
- SHA256
  
  4cfe84d411747dfd7dea548fe279bb3e74042e12a658f08306c970bbfde5519d
- SHA512
  
  05f626ec4752e503c19139c20d275f16621e91d7d7383975a2b7ed91622df384f8376b04ce0dca79177da87b40f225a9f31a051b29bb1474585dd2d01b837c81
- SSDEEP
  
  768:kY3zgnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3bsGn:3gxOx6baIa9ROj00ljEwzGi1dDnDrgS
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation