njrat | 857f5e340c4014f80a7350f97d72193698aee91e268e0624319a7cfba543d5ce | Triage

Sharing

General

Target

Server.exe
Size

93KB
Sample

250403-mny7saxqz7
MD5

df83e5c16a02997ee9695ac67e4a39ff
SHA1

b5c3836aaa48aa63330fe9eb8f922add619b0db4
SHA256

857f5e340c4014f80a7350f97d72193698aee91e268e0624319a7cfba543d5ce
SHA512

3eb3d5dd592259ff0ba1dd8dee87a15067e0e9573476d125256c924438abaf240ee61ca73103ff8dab04d7ab4eb7e9128dc848f38be4008bf1a323a2c60c8d03
SSDEEP

1536:nU/r7EkrjaFIs7E5OxzJn8LjEwzGi1dDwDjgS:nU7jau5OVVni1dec

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

entire-buildings.gl.at.ply.gg:25281

Mutex

95eba1b7a790734c4b1340271953259e

Attributes

reg_key
95eba1b7a790734c4b1340271953259e
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  df83e5c16a02997ee9695ac67e4a39ff
- SHA1
  
  b5c3836aaa48aa63330fe9eb8f922add619b0db4
- SHA256
  
  857f5e340c4014f80a7350f97d72193698aee91e268e0624319a7cfba543d5ce
- SHA512
  
  3eb3d5dd592259ff0ba1dd8dee87a15067e0e9573476d125256c924438abaf240ee61ca73103ff8dab04d7ab4eb7e9128dc848f38be4008bf1a323a2c60c8d03
- SSDEEP
  
  1536:nU/r7EkrjaFIs7E5OxzJn8LjEwzGi1dDwDjgS:nU7jau5OVVni1dec
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation