General
-
Target
149069598db31db305dbd822b156e249.exe
-
Size
36KB
-
Sample
231205-v4hhzadc7z
-
MD5
149069598db31db305dbd822b156e249
-
SHA1
853df6ed8db672664f7c4e5911cf73c8330c9c04
-
SHA256
5869f74791cb84c168e2d6ece00b536880a29db0b59ef963d5a543ab3e2bb89d
-
SHA512
61c17297406706196297707b55412eddc3ecdd7c2fdfc424a37262a114a75f4d1fb1bf99e5b03be0f1bc12dd941b0f97e69846cc0b8a648059b7e05e8987bfbb
-
SSDEEP
384:dxqCKMizd3jnBhFbJ8ycPj93tRwympVrAF+rMRTyN/0L+EcoinblneHQM3epzXhr:dECg3lLJfcPj9XNm7rM+rMRa8NuX5t
Behavioral task
behavioral1
Sample
149069598db31db305dbd822b156e249.exe
Resource
win7-20231201-en
Malware Config
Extracted
njrat
im523
HacKed
2.tcp.eu.ngrok.io:16458
af78e772b16b220a2184770c875037cc
-
reg_key
af78e772b16b220a2184770c875037cc
-
splitter
|'|'|
Targets
-
-
Target
149069598db31db305dbd822b156e249.exe
-
Size
36KB
-
MD5
149069598db31db305dbd822b156e249
-
SHA1
853df6ed8db672664f7c4e5911cf73c8330c9c04
-
SHA256
5869f74791cb84c168e2d6ece00b536880a29db0b59ef963d5a543ab3e2bb89d
-
SHA512
61c17297406706196297707b55412eddc3ecdd7c2fdfc424a37262a114a75f4d1fb1bf99e5b03be0f1bc12dd941b0f97e69846cc0b8a648059b7e05e8987bfbb
-
SSDEEP
384:dxqCKMizd3jnBhFbJ8ycPj93tRwympVrAF+rMRTyN/0L+EcoinblneHQM3epzXhr:dECg3lLJfcPj9XNm7rM+rMRa8NuX5t
Score10/10-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1