Description
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
General
Target
Size
Sample
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.bin
36KB
220610-s2x5jacfgq
Score
10/10
MD5
SHA1
SHA256
SHA512
a00a73cdc75178a115112a584c5a4dbf
0a862f5f6b8dd211e966e74a3de3e4f1224bae6d
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e
91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff
Malware Config
Extracted
| Family | netdooka |
| C2 |
http://93.115.21.45/gtaddress |
Targets
Target
MD5
Filesize
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.bin
a00a73cdc75178a115112a584c5a4dbf
36KB
Score
10/10
SHA1
SHA256
SHA512
0a862f5f6b8dd211e966e74a3de3e4f1224bae6d
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e
91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff
Tags
Signatures
-
NetDooka
-
Creates new service(s)
Tags
TTPs
-
Executes dropped EXE
-
Stops running service(s)
Tags
TTPs
-
Checks for any installed AV software in registry
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
1/10