Overview

overview

10

Static

static

10

8a429aab8c...3a.exe

windows7-x64

8

8a429aab8c...3a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57b8df6044bbfa7706f1b900216d1da0.bin

  • Size

    34KB

  • Sample

    230706-bxlghahh6z

  • MD5

    7d795b43f72fea0d14469bcb36bfc950

  • SHA1

    03a3613b435819ba7bd3903bc4e2310ce0d4dc7a

  • SHA256

    d54cbdff24d6e37dd3179e0cf0cb3b9300f0a108c1dcf96acad227cba3328bb8

  • SHA512

    4b140cdd6d018af35efb6af74ae90c1c727faca5721c7bb1b39c157dcf46d2bacee9fb64f81e253b43788d752931667314aaa8bc013557b0068193165347f8d9

  • SSDEEP

    768:8/uSi6H3+S4Sa0oR/G3fmWqiNklrnBrejdq98XAn/TtFUOj+S:8/uD6H3+bSaxkvc1sLXAn/vRjL

Score
10/10
njrathackerevasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKER

C2

hakim32.ddns.net:2000

numbers-characterization.at.ply.gg:45038
Mutex

ba79c07aec28b61ac839eeb4fafa3141

Attributes
  • reg_key

    ba79c07aec28b61ac839eeb4fafa3141

  • splitter

    |'|'|

Targets

    • Target

      8a429aab8c6fb77e858386f53694c6239f7088ed58ac73c25bb2969cbf87cb3a.bin

    • Size

      93KB

    • MD5

      57b8df6044bbfa7706f1b900216d1da0

    • SHA1

      a21f6e715a41e61820ebb3e428242f848e0cd4c9

    • SHA256

      8a429aab8c6fb77e858386f53694c6239f7088ed58ac73c25bb2969cbf87cb3a

    • SHA512

      a4670d23fe66c7ce53ccc79342b9927e7f08e62401d105116517d7e75741eae852eec1d4b4c11ea8a1e5213ed6ddc2dd74e0fe8ac45ece46f5e12bac8f6e5ee0

    • SSDEEP

      1536:oqHFQWqkqqoLc2mUiIjEwzGi1dDjDbgS:oqHmkqqoA2zi5i1djU

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks