Overview

overview

10

Static

static

10

c92662ee29...13.exe

windows7_x64

8

c92662ee29...13.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c92662ee291050ca3538a617f892ca5e8f54fa781f9e3f56aac85c49d77e2f13

  • Size

    53KB

  • Sample

    220520-21q49sbcgn

  • MD5

    9f68e8d3d56e207be9f3814f5f084cd3

  • SHA1

    d4fb2293908d00b17c232d614e6e3a9fcb217bf8

  • SHA256

    c92662ee291050ca3538a617f892ca5e8f54fa781f9e3f56aac85c49d77e2f13

  • SHA512

    80b45935c4de14c57035caf9d401671c318b07229ed74fb0cd96500cbff4073b4d218d3d425d1ce65b3f6b8fdeb9fda0b343572e67971ae3f8a54d942060b35e

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1,94.242.11.13:3784

Mutex

eb4e9f3d65482a77bc0d3a7471027899

Attributes
  • reg_key

    eb4e9f3d65482a77bc0d3a7471027899

  • splitter

    |'|'|

Targets

    • Target

      c92662ee291050ca3538a617f892ca5e8f54fa781f9e3f56aac85c49d77e2f13

    • Size

      53KB

    • MD5

      9f68e8d3d56e207be9f3814f5f084cd3

    • SHA1

      d4fb2293908d00b17c232d614e6e3a9fcb217bf8

    • SHA256

      c92662ee291050ca3538a617f892ca5e8f54fa781f9e3f56aac85c49d77e2f13

    • SHA512

      80b45935c4de14c57035caf9d401671c318b07229ed74fb0cd96500cbff4073b4d218d3d425d1ce65b3f6b8fdeb9fda0b343572e67971ae3f8a54d942060b35e

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks