Overview

overview

10

Static

static

10

QUYRMHO.exe

windows7-x64

8

QUYRMHO.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUYRMHO.html

  • Size

    23KB

  • Sample

    220929-qwmeqscack

  • MD5

    8d2d628d431ad6078501e410e7296161

  • SHA1

    a54b8497bb6d9d2293f05065959dbf22a86fa222

  • SHA256

    24381711d4be8eb84add235150e79594cde54d4bbce50aff0e0a176c90a03a88

  • SHA512

    d3ecb4da2ab1f9f7a9e96bc00e1473356f96a7c6fa12c74b019cbda84e5c162fef9a25debeee852f72bf95a1f5d45e2c235169d812a92c4ba3728d8261c65ed3

  • SSDEEP

    384:kc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZW5:q873kgNfoaf6ARpcnu9

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:443

Mutex

f2e23107ff570706937a6c495bcf1f83

Attributes
  • reg_key

    f2e23107ff570706937a6c495bcf1f83

  • splitter

    @!#&^%$

Targets

    • Target

      QUYRMHO.html

    • Size

      23KB

    • MD5

      8d2d628d431ad6078501e410e7296161

    • SHA1

      a54b8497bb6d9d2293f05065959dbf22a86fa222

    • SHA256

      24381711d4be8eb84add235150e79594cde54d4bbce50aff0e0a176c90a03a88

    • SHA512

      d3ecb4da2ab1f9f7a9e96bc00e1473356f96a7c6fa12c74b019cbda84e5c162fef9a25debeee852f72bf95a1f5d45e2c235169d812a92c4ba3728d8261c65ed3

    • SSDEEP

      384:kc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZW5:q873kgNfoaf6ARpcnu9

    Score
    8/10
    evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks