Overview

overview

10

Static

static

10

file.exe

windows7-x64

8

file.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    93KB

  • Sample

    230629-b4n6zabf66

  • MD5

    097de0afe9c3cb4bb0b145755b03c4c3

  • SHA1

    a8814d5bf9a3549ea52f0ddd65a7ad20cdeabd35

  • SHA256

    7b489b2c0652daa155af036c9ff79d55c69815bec3eb3e5d0f8489195ed16af0

  • SHA512

    71569b56cd7821c391bc00e20f354e5515c9aead4a7f9dd85fc7afc03a6eb29d89d317f383a819da160ced555525d7321149f1a459d48c1eddee4c15e63a82a9

  • SSDEEP

    1536:oUh3wHyNxrBhh5YLg1jEwzGi1dDyDwgS:oUkyNxrBhLggCi1dUZ

Score
10/10
njrathackerevasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKER

C2

hakim32.ddns.net:2000

5683812xs-43939.portmap.host:43939
Mutex

88410830574930bcf2521cc95aeeafe7

Attributes
  • reg_key

    88410830574930bcf2521cc95aeeafe7

  • splitter

    |'|'|

Targets

    • Target

      file.exe

    • Size

      93KB

    • MD5

      097de0afe9c3cb4bb0b145755b03c4c3

    • SHA1

      a8814d5bf9a3549ea52f0ddd65a7ad20cdeabd35

    • SHA256

      7b489b2c0652daa155af036c9ff79d55c69815bec3eb3e5d0f8489195ed16af0

    • SHA512

      71569b56cd7821c391bc00e20f354e5515c9aead4a7f9dd85fc7afc03a6eb29d89d317f383a819da160ced555525d7321149f1a459d48c1eddee4c15e63a82a9

    • SSDEEP

      1536:oUh3wHyNxrBhh5YLg1jEwzGi1dDyDwgS:oUkyNxrBhLggCi1dUZ

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks