Overview

overview

10

Static

static

10

6c3183412f...93.exe

windows7-x64

8

6c3183412f...93.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09a039699d3c2b826e5e2f8ad90f50fc.bin

  • Size

    16KB

  • Sample

    230326-bdm6zsgh7x

  • MD5

    40df0e0d5eaee45752f7161061540209

  • SHA1

    d00bde832e6ee6495402e8da927542ba4c097d54

  • SHA256

    820556288ad2292d0ce28199eb7d4b25fe52cb53565a6a6e06d6b99d0ba998ab

  • SHA512

    ddfec673d903b729ca20fe52f65c67fea06bcd9274ed2b18f07cd8311694f0a09e6f74aa2be116159fbd882066e2d52a62e6e6af648659ee0550e335fd67107e

  • SSDEEP

    384:pQ3aN/dB438bQ63UUu2AACXN8RCfckDoqJsqOu6n1x9/5jDDxG4snX:pQaCswD8RCfckEqJsqOt1PRjgBnX

Score
10/10
njrathackedevasionpersistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

8.tcp.ngrok.io:10809

Mutex

477e42ad55ebd15287499bd5aac86f08

Attributes
  • reg_key

    477e42ad55ebd15287499bd5aac86f08

  • splitter

    |'|'|

Targets

    • Target

      6c3183412fc318d586ba196d42f9399ecc84500d4624377752b4952442236093.exe

    • Size

      37KB

    • MD5

      09a039699d3c2b826e5e2f8ad90f50fc

    • SHA1

      158c98ba265e4829c203771eb566d607c5ab0f72

    • SHA256

      6c3183412fc318d586ba196d42f9399ecc84500d4624377752b4952442236093

    • SHA512

      a17c7e95fd27806da95776a81fe864e8050cbbaeb9d937ddbf2ef6dd38c88dfab5017df6706e9c1e74b51ff9ebdad22a9e78b21dcf6d8351dbba1a9c6df1d547

    • SSDEEP

      384:/0qBkiyjnDNGRn5IyUvapIrPbh+/VsIt6xrAF+rMRTyN/0L+EcoinblneHQM3epD:M35M5jUvairANsIQxrM+rMRa8Nuu0t

    Score
    8/10
    evasionpersistence

    • Modifies Windows Firewall

      evasion

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks