Overview

overview

10

Static

static

10

a0ab90b449...ff.exe

windows7-x64

8

a0ab90b449...ff.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0ab90b4490216516636d325d1a1d6ff.exe

  • Size

    37KB

  • Sample

    230324-k6sfvadc82

  • MD5

    a0ab90b4490216516636d325d1a1d6ff

  • SHA1

    794c4e7e7fbb9623995b71f9adb3d8c2b1b2a3df

  • SHA256

    e0c20f5a29873f39946092bb1a3a8c4be9b0dcf8a642e05bfc96e317cb19c7bc

  • SHA512

    2f2d01ce2dfed25f009b26b331f66139b3a45855cbbd68947f9577616e9f9e584e9c7bf6a30e1e697b206cc2b91687b19bca084aa2a0303a946f516769abb9a7

  • SSDEEP

    384:R286WIiejtCVLO309Qmykrt4QdqMjf+vWEWYrAF+rMRTyN/0L+EcoinblneHQM3/:1HdGdkrOGb+eE7rM+rMRa8NuDIt

Score
10/10
njrathackedevasionpersistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

159.69.153.93:5552

Mutex

0d698f966f33827a4c6bfcafca2ab9ed

Attributes
  • reg_key

    0d698f966f33827a4c6bfcafca2ab9ed

  • splitter

    |'|'|

Targets

    • Target

      a0ab90b4490216516636d325d1a1d6ff.exe

    • Size

      37KB

    • MD5

      a0ab90b4490216516636d325d1a1d6ff

    • SHA1

      794c4e7e7fbb9623995b71f9adb3d8c2b1b2a3df

    • SHA256

      e0c20f5a29873f39946092bb1a3a8c4be9b0dcf8a642e05bfc96e317cb19c7bc

    • SHA512

      2f2d01ce2dfed25f009b26b331f66139b3a45855cbbd68947f9577616e9f9e584e9c7bf6a30e1e697b206cc2b91687b19bca084aa2a0303a946f516769abb9a7

    • SSDEEP

      384:R286WIiejtCVLO309Qmykrt4QdqMjf+vWEWYrAF+rMRTyN/0L+EcoinblneHQM3/:1HdGdkrOGb+eE7rM+rMRa8NuDIt

    Score
    8/10
    evasionpersistence

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks