General
-
Target
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe
-
Size
37KB
-
Sample
240222-ge76facf4x
-
MD5
ad0156e5bbf9a8b4defed3d0498e8ad7
-
SHA1
b1d33aece27718c83348487b1623fe246e7bbff8
-
SHA256
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c
-
SHA512
f24983e7a6e3f472b7e73036977d39a2ddf6af0c099146b44983f0a183120c1fbb49ffe20a67654849644e6e104eb6c800db89495bef4a38a02a0f53afa29f6e
-
SSDEEP
384:njrvUiSAL1G5k2gyk/Kyvj0/6sXwEcrAF+rMRTyN/0L+EcoinblneHQM3epzXoN/:jrF32bk/KyYysXwJrM+rMRa8NuiLt
Behavioral task
behavioral1
Sample
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe
Resource
win10v2004-20240221-en
Malware Config
Extracted
njrat
im523
Hacked
0.tcp.eu.ngrok.io:19599
3a8ee47129614a8ed745ed44d22e4759
-
reg_key
3a8ee47129614a8ed745ed44d22e4759
-
splitter
|'|'|
Targets
-
-
Target
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe
-
Size
37KB
-
MD5
ad0156e5bbf9a8b4defed3d0498e8ad7
-
SHA1
b1d33aece27718c83348487b1623fe246e7bbff8
-
SHA256
2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c
-
SHA512
f24983e7a6e3f472b7e73036977d39a2ddf6af0c099146b44983f0a183120c1fbb49ffe20a67654849644e6e104eb6c800db89495bef4a38a02a0f53afa29f6e
-
SSDEEP
384:njrvUiSAL1G5k2gyk/Kyvj0/6sXwEcrAF+rMRTyN/0L+EcoinblneHQM3epzXoN/:jrF32bk/KyYysXwJrM+rMRa8NuiLt
Score8/10-
Modifies Windows Firewall
-
Legitimate hosting services abused for malware hosting/C2
-