General

  • Target

    17684bcecd6beef28b4668f0085822004a5e0bcc5698ec7d9d903205f695448b

  • Size

    37KB

  • Sample

    220520-w9f3rsfbcp

  • MD5

    47c26a72ba3151f19185fb415c3ffaf4

  • SHA1

    fd25e338dfe3a110da4026d654129fc03c26e4fb

  • SHA256

    17684bcecd6beef28b4668f0085822004a5e0bcc5698ec7d9d903205f695448b

  • SHA512

    de57c78ba072702ac1f713f925e6a801993630a0aefc83b55008041de2513a5031fcf4f854175ac8205ca10434ec268fa269d459093a57ce4f667a2c700a90ef

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

govno123.hopto.org:7777

Mutex

aeeb555159010b7ad67deb5b72c235aa

Attributes
  • reg_key

    aeeb555159010b7ad67deb5b72c235aa

  • splitter

    |'|'|

Targets

    • Target

      17684bcecd6beef28b4668f0085822004a5e0bcc5698ec7d9d903205f695448b

    • Size

      37KB

    • MD5

      47c26a72ba3151f19185fb415c3ffaf4

    • SHA1

      fd25e338dfe3a110da4026d654129fc03c26e4fb

    • SHA256

      17684bcecd6beef28b4668f0085822004a5e0bcc5698ec7d9d903205f695448b

    • SHA512

      de57c78ba072702ac1f713f925e6a801993630a0aefc83b55008041de2513a5031fcf4f854175ac8205ca10434ec268fa269d459093a57ce4f667a2c700a90ef

    Score
    8/10
    • Modifies Windows Firewall

    • Drops startup file

    • Adds Run key to start application

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Lateral Movement

Replication Through Removable Media

1
T1091

Tasks