Overview

overview

10

Static

static

10

1d9633b94f...f6.exe

windows7-x64

8

1d9633b94f...f6.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1d9633b94f8cff6aebe79da9f100a8d85432910f16c8953b5bc4af9e33b292f6

  • Size

    93KB

  • Sample

    231229-aagdlabfgk

  • MD5

    0c53c3f4e1d15472e28eece8e12c1ba3

  • SHA1

    e3bbdce44feb9ecca23d4c3a3f830b4d9c2d83ad

  • SHA256

    1d9633b94f8cff6aebe79da9f100a8d85432910f16c8953b5bc4af9e33b292f6

  • SHA512

    cd712b8d00436c152c4abef6766fc6c7c069b1a50cde65f3e5a4194fe5e39bd3b5c1f6d51087df692db7c687cb8d8fb58e6727fa9eb5d1646ce6d21657d42a1e

  • SSDEEP

    768:CY32UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk39sGv:0UxOx6baIa9RZj00ljEwzGi1dDNDLgS

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

6.tcp.eu.ngrok.io:10883
Mutex

9e9faa9919684e0fc28630a083f73cc1

Attributes
  • reg_key

    9e9faa9919684e0fc28630a083f73cc1

  • splitter

    |'|'|

Targets

    • Target

      1d9633b94f8cff6aebe79da9f100a8d85432910f16c8953b5bc4af9e33b292f6

    • Size

      93KB

    • MD5

      0c53c3f4e1d15472e28eece8e12c1ba3

    • SHA1

      e3bbdce44feb9ecca23d4c3a3f830b4d9c2d83ad

    • SHA256

      1d9633b94f8cff6aebe79da9f100a8d85432910f16c8953b5bc4af9e33b292f6

    • SHA512

      cd712b8d00436c152c4abef6766fc6c7c069b1a50cde65f3e5a4194fe5e39bd3b5c1f6d51087df692db7c687cb8d8fb58e6727fa9eb5d1646ce6d21657d42a1e

    • SSDEEP

      768:CY32UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk39sGv:0UxOx6baIa9RZj00ljEwzGi1dDNDLgS

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks