njrat | 7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898 | Triage

Sharing

General

Target

7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898.exe
Size

37KB
Sample

250326-pbnavs1yhy
MD5

24ab0ba0700aff18d46f4b4858907567
SHA1

d4a9f83e3729733d6f9f43bf8d0b475eb0fdba2b
SHA256

7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898
SHA512

b3d404452b01720f4a4756e8e409cdee93e830186e78c4c30c3247caab4150c98987fb507657a6f929fb5d26a02a5092a873cb8883521a5b06da7b362ac4e727
SSDEEP

384:VetvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXX:4t7TZ38fvCv3E1c1rM+rMRa8Nu8it

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:12629

Mutex

2025b9f237c2fb27c13d52e4a198434b

Attributes

reg_key
2025b9f237c2fb27c13d52e4a198434b
splitter
|'|'|

Targets

- Target
  
  7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898.exe
- Size
  
  37KB
- MD5
  
  24ab0ba0700aff18d46f4b4858907567
- SHA1
  
  d4a9f83e3729733d6f9f43bf8d0b475eb0fdba2b
- SHA256
  
  7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898
- SHA512
  
  b3d404452b01720f4a4756e8e409cdee93e830186e78c4c30c3247caab4150c98987fb507657a6f929fb5d26a02a5092a873cb8883521a5b06da7b362ac4e727
- SSDEEP
  
  384:VetvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXX:4t7TZ38fvCv3E1c1rM+rMRa8Nu8it
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation