General

  • Target

    55445ef6261ed803ea65e9cb491d50a6884903f8301da5ca1b9449dad4de8612.exe

  • Size

    37KB

  • Sample

    240228-t7fccagf5w

  • MD5

    bb540ca02e338d2a4a86785776f780c5

  • SHA1

    347a77103e27f5c463948d88870b0ba48045e3bf

  • SHA256

    55445ef6261ed803ea65e9cb491d50a6884903f8301da5ca1b9449dad4de8612

  • SHA512

    8de7a6c1d416f7ec9151f31341c8dc77676f8379c1183223699a852dbf30cc6cfd168c6f057b8016fda5998bd6600f21e176cb6f4f95343fbb034e1b007e52af

  • SSDEEP

    384:TemOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM9:T4FdGdkrgYRwWS9rM+rMRa8Nu6tt

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:15451

Mutex

1026a75483502437f7df6cd87292f363

Attributes
  • reg_key

    1026a75483502437f7df6cd87292f363

  • splitter

    |'|'|

Targets

    • Target

      55445ef6261ed803ea65e9cb491d50a6884903f8301da5ca1b9449dad4de8612.exe

    • Size

      37KB

    • MD5

      bb540ca02e338d2a4a86785776f780c5

    • SHA1

      347a77103e27f5c463948d88870b0ba48045e3bf

    • SHA256

      55445ef6261ed803ea65e9cb491d50a6884903f8301da5ca1b9449dad4de8612

    • SHA512

      8de7a6c1d416f7ec9151f31341c8dc77676f8379c1183223699a852dbf30cc6cfd168c6f057b8016fda5998bd6600f21e176cb6f4f95343fbb034e1b007e52af

    • SSDEEP

      384:TemOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM9:T4FdGdkrgYRwWS9rM+rMRa8Nu6tt

    Score
    8/10
    • Modifies Windows Firewall

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks