Overview

overview

10

Static

static

10

1e9bf2f7d2...f7.exe

windows7-x64

8

1e9bf2f7d2...f7.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90b0c7da58ca8fb02df425f5fe4d6f99ebc680f0deeabb4d3a6a6f3ea566d046

  • Size

    16KB

  • Sample

    240419-v8bafsbf8s

  • MD5

    ed07bd695f46f95ee8af6e0b6f7168ac

  • SHA1

    4643dbe3f0d81256bb59b852c3f5b61a01284002

  • SHA256

    90b0c7da58ca8fb02df425f5fe4d6f99ebc680f0deeabb4d3a6a6f3ea566d046

  • SHA512

    f88f02e426941eb182d33c7f0596b13de9fc9cb10ac229155b934bb723d5733a24ac47c46389794c71f836e02a61b209631a057d1cdc347ddd6c5d700dcabe87

  • SSDEEP

    384:Ow1YGxCqVzCzd40k0VpG1ryzWNzB5gcnROo2jerBZZZ:7YG7V70k0Vk1FN5gCO3Y

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:18838

Mutex

6ef7a07599da7096f5824a9ad600fb5b

Attributes
  • reg_key

    6ef7a07599da7096f5824a9ad600fb5b

  • splitter

    |'|'|

Targets

    • Target

      1e9bf2f7d2e70e7c968172ef2a9b38ed480d349d59516afe8d2eaf4ad5df4af7.exe

    • Size

      37KB

    • MD5

      0d692c15bec7a59a4fc336efb74ec898

    • SHA1

      2909f371ec5860ea74d47ba9c1205f985a15b026

    • SHA256

      1e9bf2f7d2e70e7c968172ef2a9b38ed480d349d59516afe8d2eaf4ad5df4af7

    • SHA512

      249b1b0c4b575278732a26f9d533870396384734c879802257655f9c2a8d695b83d57166a01013b5ec4b0cfbf2baea1c2814d6e83dc45249ad74a5d05343d4e3

    • SSDEEP

      384:heSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXq:US7TZ38fvCv3E1cQrM+rMRa8Numft

    Score
    8/10
    evasion

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks