njrat | eec342108ef89c3d961091d73139927a15447bb95f2cc8dcd5e87dd64d98846a | Triage™

Login
Reports

Overview

overview

Static

static

update.exe

windows10-2004-x64

8

update.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
5_update.rar
Size 12KB
Sample260720-gy1kpsbs4v
SHA256 eec342108ef89c3d961091d73139927a15447bb95f2cc8dcd5e87dd64d98846a
MD5 0b4fb4a1a38ccfd1a0122372a16ae002
SHA1 fbb850b2f0a8f717d9990ecd096280084ccc23ba
SHA512 375b67d891fc5ffa739869b078690f42eb1c1e965e16c9fd5dd90524e3171d39e0982bdbfa1a82b25a4a5685e34387d61c968017721ebd4b3e33e04bf7819c10
SSDEEP 384:VtCR1QD5ZoUjxgy6mlzJgwya/MqLChp++2M3XD:VMAfjxgSlzJgLgMZl2M3XD
TLSH
T1D842D19E41DE9CAF22A65066D79DAFC610B2E3F3B16084372F8685BE10D35458B0DE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

njrat svhost defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

2 signatures

svhost trojan njrat

Behavioral task

behavioral1

Sample

update.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Behavioral task

behavioral2

Sample

update.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

svhost

C2

kolall.ddns.net:1177

Mutex

043ed596af7365236306a463494dc0f4

Attributes

reg_key
043ed596af7365236306a463494dc0f4
splitter
|'|'|

Targets

- Target
  update.exe
- Size 29KB
- SHA256 d850f29d16502c6fdfaf0e6e2223bcb60f04a73972216b94720094e9fec93d80
- MD5 ddac8795a38bb1634f361c9769d7af4d
- SHA1 cd93f07e90cf92a2d9e95f45a43e45aef007a7f6
- SHA512 1e154fa7840b436b7e0293355845bdd5220d388349a3137c718e53d11441b8d016c3ab2e03c6344d2aeeefa9e13c4e39e985106bd9711c947669b371183bbc0b
- SSDEEP 384:fdpQjtl7jBnoKoK3JtF5LraciumqD0sDeoFGBsbh0w4wlAokw9OhgOL1vYRGOZzK:f67hoKoGJDFaccqJDe5BKh0p29SgRAb
- TLSH
  T156D21A1937B54906C8BC0B74C9319A2756F486032913DFAFDDC1A9DA9EB32E8194CFE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

svhosttrojannjrat

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation

© 2018-2026

Terms | Privacy