Overview

overview

10

Static

static

10

87dd4fa4c6...b2.exe

windows7-x64

8

87dd4fa4c6...b2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87dd4fa4c64c5cb6f8c62fc78ba7d6b2.exe

  • Size

    37KB

  • Sample

    230318-cy6phaah78

  • MD5

    87dd4fa4c64c5cb6f8c62fc78ba7d6b2

  • SHA1

    2e61aa8b483abff6b8ca7b2c579e11ba2d17533c

  • SHA256

    87a45ccd4752b8201dd2d4f5271966b3b6175ac203710d7f6a2f2b64a35dd2cc

  • SHA512

    6906809d9711698d4baae457688c9a787a34d595f2ef86ea3d550e11a43fda2547ed147123ecee9025846659b47689be878230da2cd9f65af3628d71bcf937b7

  • SSDEEP

    384:XIbsiDlT95hL5YyUvjh/xOi4aaF3lrAF+rMRTyN/0L+EcoinblneHQM3epzXCNrx:45v5zUvjhDlaRlrM+rMRa8NusVt

Score
10/10
njrathackedevasionpersistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

send-diversity.at.ply.gg:1177

Mutex

1b2f122daee01657707c7a53c29f5f60

Attributes
  • reg_key

    1b2f122daee01657707c7a53c29f5f60

  • splitter

    |'|'|

Targets

    • Target

      87dd4fa4c64c5cb6f8c62fc78ba7d6b2.exe

    • Size

      37KB

    • MD5

      87dd4fa4c64c5cb6f8c62fc78ba7d6b2

    • SHA1

      2e61aa8b483abff6b8ca7b2c579e11ba2d17533c

    • SHA256

      87a45ccd4752b8201dd2d4f5271966b3b6175ac203710d7f6a2f2b64a35dd2cc

    • SHA512

      6906809d9711698d4baae457688c9a787a34d595f2ef86ea3d550e11a43fda2547ed147123ecee9025846659b47689be878230da2cd9f65af3628d71bcf937b7

    • SSDEEP

      384:XIbsiDlT95hL5YyUvjh/xOi4aaF3lrAF+rMRTyN/0L+EcoinblneHQM3epzXCNrx:45v5zUvjhDlaRlrM+rMRa8NusVt

    Score
    8/10
    evasionpersistence

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks