General
-
Target
Server.exe
-
Size
36KB
-
Sample
220613-lcmh6sbdb5
-
MD5
5fac7c4b8512fe35e5282ad2645a78ec
-
SHA1
ecb53381d5e9744e5dd9d4a8dbd70cae92ca3379
-
SHA256
6c834041f5fdd1baf99123f6154cbfd54b1db4bf993d42dfe8a6e25702dd8d1e
-
SHA512
ce20409e0d22b36cb9f78091151e2df8017284ac31da9b19a6ee0a5e6a11d217d000e8ecca372e9982688212cb882ec2e3911fb4409377b05646aa0bf5ebaccc
Malware Config
Extracted
njrat
im523
HacKed
4.tcp.eu.ngrok.io:15404
36c1c9c1013378697034f432be0b8536
-
reg_key
36c1c9c1013378697034f432be0b8536
-
splitter
|'|'|
Extracted
njrat
im523
popka
185.204.1.236:8648
73669228637201240c020112fc761ef3
-
reg_key
73669228637201240c020112fc761ef3
-
splitter
|'|'|
Targets
-
-
Target
Server.exe
-
Size
36KB
-
MD5
5fac7c4b8512fe35e5282ad2645a78ec
-
SHA1
ecb53381d5e9744e5dd9d4a8dbd70cae92ca3379
-
SHA256
6c834041f5fdd1baf99123f6154cbfd54b1db4bf993d42dfe8a6e25702dd8d1e
-
SHA512
ce20409e0d22b36cb9f78091151e2df8017284ac31da9b19a6ee0a5e6a11d217d000e8ecca372e9982688212cb882ec2e3911fb4409377b05646aa0bf5ebaccc
-
Detect Neshta Payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
-
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)
-
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
-
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-