Overview

overview

10

Static

static

10

1f3f2f032b...59.exe

windows7-x64

8

1f3f2f032b...59.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f3f2f032b31e67ed1c10acfe279a759.exe

  • Size

    37KB

  • Sample

    220919-3r92fsfcdj

  • MD5

    1f3f2f032b31e67ed1c10acfe279a759

  • SHA1

    65f9c5514e141aa69f72eada41721a033e43ba70

  • SHA256

    b83fd7fa8ce7fcd989dec26c5fff0c5a56ae958d19964f991ad166d40d9c70fe

  • SHA512

    e38f701b84b6e652ad4e0b372d01c1a079b35c8bad9c9e7b3cb0b9717571755cefd497ee4d4b5ad9c7eef4e4df539e729193384b5cffc880e11e3d2f26ab1595

  • SSDEEP

    384:omOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3V:+FdGdkrgYRwWS9rM+rMRa8Nucft

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:13880

Mutex

3c73062791d6f0df21ade09cbfecbb51

Attributes
  • reg_key

    3c73062791d6f0df21ade09cbfecbb51

  • splitter

    |'|'|

Targets

    • Target

      1f3f2f032b31e67ed1c10acfe279a759.exe

    • Size

      37KB

    • MD5

      1f3f2f032b31e67ed1c10acfe279a759

    • SHA1

      65f9c5514e141aa69f72eada41721a033e43ba70

    • SHA256

      b83fd7fa8ce7fcd989dec26c5fff0c5a56ae958d19964f991ad166d40d9c70fe

    • SHA512

      e38f701b84b6e652ad4e0b372d01c1a079b35c8bad9c9e7b3cb0b9717571755cefd497ee4d4b5ad9c7eef4e4df539e729193384b5cffc880e11e3d2f26ab1595

    • SSDEEP

      384:omOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3V:+FdGdkrgYRwWS9rM+rMRa8Nucft

    Score
    8/10
    evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks