Overview

overview

10

Static

static

10

bNqu.exe

windows7-x64

7

bNqu.exe

windows10-2004-x64

1

Resubmissions

08-06-2023 13:17

230608-qjqxdsff26 10

07-06-2023 15:10

230607-sj1gyaca54 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bNqu.exe

  • Size

    78KB

  • Sample

    230607-sj1gyaca54

  • MD5

    d4b127a7d4e2609d86747eadf6fd00ba

  • SHA1

    88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab

  • SHA256

    a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37

  • SHA512

    f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488

  • SSDEEP

    1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM

Score
10/10
njratprimas_2023

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Primas_2023

C2

administradorv.duckdns.org:2019

Mutex

Notepad.exe

Attributes
  • reg_key

    Notepad.exe

  • splitter

    1234

Targets

    • Target

      bNqu.exe

    • Size

      78KB

    • MD5

      d4b127a7d4e2609d86747eadf6fd00ba

    • SHA1

      88754fa2fa044a1bcac7ad1ede8c8cfa533bbdab

    • SHA256

      a4565de8728f2196a30e7337c45d94b0b7f8dfca1bd610f5bd0d597e483d1b37

    • SHA512

      f7d36d3f931d75793f1ee55bd7be5a3edc8c5ebff198a5eac0d234eb2964c78b6a071c38a1042ea3b4aad50d8be77998d3922c075d4aed838e0b6d5d960f2488

    • SSDEEP

      1536:Gh9z+dBLX+DpPS5wpOk3JCK6pFo4j/6fOpd/9nEh9TGaJMR:UWqQwpOk5CK6MO/9ESaJM

    Score
    7/10

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks