Resubmissions

07-06-2023 13:47

230607-q31kyabg4s 10

02-12-2022 10:31

221202-mkezqscd8s 10

General

  • Target

    0949acdb3ac044685e9933138e5930cb.exe

  • Size

    93KB

  • Sample

    230607-q31kyabg4s

  • MD5

    0949acdb3ac044685e9933138e5930cb

  • SHA1

    fdee32362543952c69486b3b864dcc7273323958

  • SHA256

    7c9436f319c034794960bf8864a3b4930ff7b059a1673810cfe172d16a3e9785

  • SHA512

    e27dfc02136bd1b51dd5fefad35a95d66506a3a018c137d4ef1f2af9c3717bae3e12cbec1df8bfb095041d8374952bd3387e936ca845ffa3d0fae9960d0f8885

  • SSDEEP

    1536:9VwC+xhUa9urgOBPJNvM4jEwzGi1dDPD+gS:9VmUa9urgODdGi1d3j

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

FRANSESCOC50Y3AuZXUubmdyb2suaW8Strik:MTE1NDQ=

Mutex

699fc2ccf0199f84a3b63235515375f3

Attributes
  • reg_key

    699fc2ccf0199f84a3b63235515375f3

  • splitter

    |'|'|

Targets

    • Target

      0949acdb3ac044685e9933138e5930cb.exe

    • Size

      93KB

    • MD5

      0949acdb3ac044685e9933138e5930cb

    • SHA1

      fdee32362543952c69486b3b864dcc7273323958

    • SHA256

      7c9436f319c034794960bf8864a3b4930ff7b059a1673810cfe172d16a3e9785

    • SHA512

      e27dfc02136bd1b51dd5fefad35a95d66506a3a018c137d4ef1f2af9c3717bae3e12cbec1df8bfb095041d8374952bd3387e936ca845ffa3d0fae9960d0f8885

    • SSDEEP

      1536:9VwC+xhUa9urgOBPJNvM4jEwzGi1dDPD+gS:9VmUa9urgODdGi1d3j

    Score
    8/10
    • Disables Task Manager via registry modification

    • Modifies Windows Firewall

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Command and Control

Web Service

1
T1102

Tasks