Overview

overview

10

Static

static

10

846e326bf4...ff.exe

windows7-x64

8

846e326bf4...ff.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6f492c77854936f08353fd01db226273a6312077e90d2eddd8acfc6e49604fe

  • Size

    17KB

  • Sample

    240419-vaxe2ahf53

  • MD5

    2acb078dcd52bbc64949c61d66cc6e58

  • SHA1

    66d9c9c03a7dcfc3e453251c438b4945b000ac53

  • SHA256

    d6f492c77854936f08353fd01db226273a6312077e90d2eddd8acfc6e49604fe

  • SHA512

    c30433892a949efe9a73c9b9122b28dffa22f3995b788dfa864d3a3e84cf63b8141b986e5e2555a836345a7101af2852402982773051aef3a26db79f8411c22f

  • SSDEEP

    384:FdiE2upgTmW+S9iFif2gkoN3f4tq+6ceP83mkmfc+X0ukQz5idjeQ:LRIi4bFkO3fOqie03mkoco0gz5idjeQ

Score
10/10
njrathackedevasionpersistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:25505

Mutex

afe56b93a28a14c8bcebd0992e16ca71

Attributes
  • reg_key

    afe56b93a28a14c8bcebd0992e16ca71

  • splitter

    |'|'|

Targets

    • Target

      846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff.exe

    • Size

      37KB

    • MD5

      d0c3e7b04033acd95ef28afbb67f88fe

    • SHA1

      c5c9d57e77969aca2e42d7b644f776be17be27fd

    • SHA256

      846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff

    • SHA512

      1dcd953cfba7c54bd0a3bd5c58407d1c98c1cd82c43de3039f52d4d36a1310b4705b53fbdb04ae46e7bea9ad2fbe6a36f172018a79b274210377895711a9881a

    • SSDEEP

      384:g0SvEiTbTvpWNcZ0y8fvCv3v3cLkacJEJrAF+rMRTyN/0L+EcoinblneHQM3epz0:jS7TZ38fvCv3E1cUrM+rMRa8Nuq1t

    Score
    8/10
    evasionpersistence

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks