njrat | a434d44a603385e4ef328b1eea14aff451fe8eed724a1cbd2a3f68366665e580 | Triage™

Login
Reports

Overview

overview

Static

static

XClient.exe

windows10-ltsc_2021-x64

8

XClient.exe

windows10-2004-x64

8

XClient.exe

windows11-21h2-x64

8

XClient.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
XClient.exe
Size 93KB
Sample260814-dddzesbl8s
SHA256 a434d44a603385e4ef328b1eea14aff451fe8eed724a1cbd2a3f68366665e580
MD5 cc06a2871f692e781edaaec5fd167a78
SHA1 a8913bea178bb6ed9278ac6c4b6fb97187cbdee6
SHA512 5e4ea84184a2e42145a3b962d05f31112eacca46a7c192654f0681d2dc3f6f34f8dbbcf8ce2d3e45a37d53886f84994af103b59487737f5391617ddbc7fdd0f0
SSDEEP 1536:xUk1GkeUqZJO5iNSimjEwzGi1dDqDqgS:xUPUqZJOQAOi1d8v
TLSH
T17F93E84977E56524E0BF56F79471F2404E34B48B1602E39E48F219AA0B33AC44F89FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

njrat hacked defense_evasion discovery execution persistence privilege_escalation trojan

Static task

static1

2 signatures

hacked trojan njrat

Behavioral task

behavioral1

Sample

XClient.exe

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral2

Sample

XClient.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral3

Sample

XClient.exe

Resource

win11-20260513-en

windows11-21h2-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral4

Sample

XClient.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000
fds6gbae3v.localto.net:4294

Mutex

46e141ac3fea86fd4cb549ecaa0ceeee

Attributes

reg_key
46e141ac3fea86fd4cb549ecaa0ceeee
splitter
|'|'|

Targets

- Target
  XClient.exe
- Size 93KB
- SHA256 a434d44a603385e4ef328b1eea14aff451fe8eed724a1cbd2a3f68366665e580
- MD5 cc06a2871f692e781edaaec5fd167a78
- SHA1 a8913bea178bb6ed9278ac6c4b6fb97187cbdee6
- SHA512 5e4ea84184a2e42145a3b962d05f31112eacca46a7c192654f0681d2dc3f6f34f8dbbcf8ce2d3e45a37d53886f84994af103b59487737f5391617ddbc7fdd0f0
- SSDEEP 1536:xUk1GkeUqZJO5iNSimjEwzGi1dDqDqgS:xUPUqZJOQAOi1d8v
- TLSH
  T17F93E84977E56524E0BF56F79471F2404E34B48B1602E39E48F219AA0B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

hackedtrojannjrat

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral3

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral4

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

© 2018-2026

Terms | Privacy