Overview

overview

10

Static

static

10

b18cba68f6...d0.exe

windows7_x64

8

b18cba68f6...d0.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0

  • Size

    37KB

  • Sample

    220520-3sexpshdg9

  • MD5

    e44c426d2c3fe74ff9c10f730b212b7e

  • SHA1

    13f65b7251a56f4565213a3386448f1883f1a028

  • SHA256

    b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0

  • SHA512

    ccd2f10fbcc4a7e473f48d6abc3111759aecc816dc655c9b20e977d310580fac8e375e35d86f4ee4f7402755699acebdf03884aecbc28432fefd4c420fac9964

Score
10/10
njratdimonhackevasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

DIMONHACK

C2

89.148.241.97:9291

Mutex

12570e586ba38e24ce105cff1e0705ac

Attributes
  • reg_key

    12570e586ba38e24ce105cff1e0705ac

  • splitter

    |'|'|

Targets

    • Target

      b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0

    • Size

      37KB

    • MD5

      e44c426d2c3fe74ff9c10f730b212b7e

    • SHA1

      13f65b7251a56f4565213a3386448f1883f1a028

    • SHA256

      b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0

    • SHA512

      ccd2f10fbcc4a7e473f48d6abc3111759aecc816dc655c9b20e977d310580fac8e375e35d86f4ee4f7402755699acebdf03884aecbc28432fefd4c420fac9964

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks