General

  • Target

    cb3b0b29603049aa3bdb6d9b9a2b2cb9.exe

  • Size

    37KB

  • Sample

    230422-z7a1hsgg79

  • MD5

    cb3b0b29603049aa3bdb6d9b9a2b2cb9

  • SHA1

    09e50c801100bad1ec717b1d3b05a3ba91984c08

  • SHA256

    81707f63a5a759d1ec24ef88500899d43023921001350b885babecb0b82891fc

  • SHA512

    51686b84dfd697379d445f1e48177fc12b2e454eeb62b8b9091226594999808813ccf0b4e39275b2b2fb8e605df658419b119411186c95dfc31994b15fdad3f8

  • SSDEEP

    384:wyoPVSikmD0NVtv/Vey0bEGfFdIs+yvErAF+rMRTyN/0L+EcoinblneHQM3epzXL:94HO1VV0bEGHIVycrM+rMRa8NuRRt

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

victime

C2

england-disability.at.ply.gg:1502

Mutex

4ecadd18227360ae705bfde0ceb02fa9

Attributes
  • reg_key

    4ecadd18227360ae705bfde0ceb02fa9

  • splitter

    |'|'|

Targets

    • Target

      cb3b0b29603049aa3bdb6d9b9a2b2cb9.exe

    • Size

      37KB

    • MD5

      cb3b0b29603049aa3bdb6d9b9a2b2cb9

    • SHA1

      09e50c801100bad1ec717b1d3b05a3ba91984c08

    • SHA256

      81707f63a5a759d1ec24ef88500899d43023921001350b885babecb0b82891fc

    • SHA512

      51686b84dfd697379d445f1e48177fc12b2e454eeb62b8b9091226594999808813ccf0b4e39275b2b2fb8e605df658419b119411186c95dfc31994b15fdad3f8

    • SSDEEP

      384:wyoPVSikmD0NVtv/Vey0bEGfFdIs+yvErAF+rMRTyN/0L+EcoinblneHQM3epzXL:94HO1VV0bEGHIVycrM+rMRa8NuRRt

    Score
    8/10
    • Modifies Windows Firewall

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks