Overview

overview

10

Static

static

10

Server.exe

windows7_x64

10

Server.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    23KB

  • Sample

    211210-xrmchahec2

  • MD5

    5897ddef374e1016e25a472c6642ee0a

  • SHA1

    dfbaf5807431786f81f8e6d56fd6c6620b6c6a5e

  • SHA256

    751603c717a7896ed44dc63efcba3afc39701b4cf7abd2c36dd071559b2e4409

  • SHA512

    573950b220f41ddd86b4dcbae1b0daf8befe14081395c240cbd4e9e33fbfb9ebad0f515ff0e2a2fd27bfae35ae49035148e0fdb9d4fb85213684d8d89ebd968a

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

2.tcp.ngrok.io:555

Mutex

dc077b5d215838806e7b74f5d84b3e9e

Attributes
  • reg_key

    dc077b5d215838806e7b74f5d84b3e9e

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      23KB

    • MD5

      5897ddef374e1016e25a472c6642ee0a

    • SHA1

      dfbaf5807431786f81f8e6d56fd6c6620b6c6a5e

    • SHA256

      751603c717a7896ed44dc63efcba3afc39701b4cf7abd2c36dd071559b2e4409

    • SHA512

      573950b220f41ddd86b4dcbae1b0daf8befe14081395c240cbd4e9e33fbfb9ebad0f515ff0e2a2fd27bfae35ae49035148e0fdb9d4fb85213684d8d89ebd968a

    Score
    10/10
    njratevasionpersistencetrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks