General

  • Target

    2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe

  • Size

    37KB

  • Sample

    240222-ge76facf4x

  • MD5

    ad0156e5bbf9a8b4defed3d0498e8ad7

  • SHA1

    b1d33aece27718c83348487b1623fe246e7bbff8

  • SHA256

    2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c

  • SHA512

    f24983e7a6e3f472b7e73036977d39a2ddf6af0c099146b44983f0a183120c1fbb49ffe20a67654849644e6e104eb6c800db89495bef4a38a02a0f53afa29f6e

  • SSDEEP

    384:njrvUiSAL1G5k2gyk/Kyvj0/6sXwEcrAF+rMRTyN/0L+EcoinblneHQM3epzXoN/:jrF32bk/KyYysXwJrM+rMRa8NuiLt

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Hacked

C2

0.tcp.eu.ngrok.io:19599

Mutex

3a8ee47129614a8ed745ed44d22e4759

Attributes
  • reg_key

    3a8ee47129614a8ed745ed44d22e4759

  • splitter

    |'|'|

Targets

    • Target

      2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c.exe

    • Size

      37KB

    • MD5

      ad0156e5bbf9a8b4defed3d0498e8ad7

    • SHA1

      b1d33aece27718c83348487b1623fe246e7bbff8

    • SHA256

      2950ce9dbfde412f661b84dd8764fa9994c2a8edd92fea05a7f2c364420b151c

    • SHA512

      f24983e7a6e3f472b7e73036977d39a2ddf6af0c099146b44983f0a183120c1fbb49ffe20a67654849644e6e104eb6c800db89495bef4a38a02a0f53afa29f6e

    • SSDEEP

      384:njrvUiSAL1G5k2gyk/Kyvj0/6sXwEcrAF+rMRTyN/0L+EcoinblneHQM3epzXoN/:jrF32bk/KyYysXwJrM+rMRa8NuiLt

    Score
    8/10
    • Modifies Windows Firewall

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks