njrat | c50488a31b6ce8d0ddd65b57bd27cf8c1bc86ad0382476f813c33083c5575d6f | Triage

Resubmissions

31/03/2025, 16:17

250331-trbzzstsgx 10

30/09/2021, 22:03

210930-1ycnesadh7 10

Sharing

General

Target

C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
Size

31KB
Sample

250331-trbzzstsgx
MD5

4adad151f3c235616ce57238c32b4b34
SHA1

9d05a045e0ce402ff257d799921a9557a2569535
SHA256

c50488a31b6ce8d0ddd65b57bd27cf8c1bc86ad0382476f813c33083c5575d6f
SHA512

34b9607899e79f6e381c648f6afde801aed03e4041c9affc13d4855032d139f5164b7f2c4adfea56366d3365dd758fe9c86110b2148cc0c744f04945fc79a366
SSDEEP

768:RPwoqkZlH/azx1+ta+q3U97v8+QmIDUu0tiJYDj:s4qSp7QVkQSj

Score

10^/10

njrat cheat android defense_evasion discovery linux macos persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

cheat

C2

0.tcp.ngrok.io:11421

Mutex

33aef9319e7f69a68e51dc4a67780130

Attributes

reg_key
33aef9319e7f69a68e51dc4a67780130
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
- Size
  
  31KB
- MD5
  
  4adad151f3c235616ce57238c32b4b34
- SHA1
  
  9d05a045e0ce402ff257d799921a9557a2569535
- SHA256
  
  c50488a31b6ce8d0ddd65b57bd27cf8c1bc86ad0382476f813c33083c5575d6f
- SHA512
  
  34b9607899e79f6e381c648f6afde801aed03e4041c9affc13d4855032d139f5164b7f2c4adfea56366d3365dd758fe9c86110b2148cc0c744f04945fc79a366
- SSDEEP
  
  768:RPwoqkZlH/azx1+ta+q3U97v8+QmIDUu0tiJYDj:s4qSp7QVkQSj
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral10 behavioral11 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral3

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral4

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11