General
-
Target
d45a4e6cac86116d42bd309e238aeace1a6ea85abf4d92fdc3e77e44dbc709d1
-
Size
17KB
-
Sample
240419-vwnd9abc2t
-
MD5
1b9e22996591808adc1b951cf548636d
-
SHA1
7b903db38037324480f686ffd364c3fb1a09800d
-
SHA256
d45a4e6cac86116d42bd309e238aeace1a6ea85abf4d92fdc3e77e44dbc709d1
-
SHA512
06297cbed7671af7c026f9f4a6e36881e99f9797a1b328ff5cab90a21dc2e50b4b0e28757a23e3501e369fe4781125a246117e8add14ae1ac9ff8a4726687264
-
SSDEEP
384:vUuf5MH/NruNPVfLDm1zFcJJ3Jah7M8tpLQjirNnCmBlwPO+Ll8vR:vUCuH/Yf+cJJwhM8thvr59wBl85
Behavioral task
behavioral1
Sample
a35053dd6b939f8d9e170b46f53dd4206da004360d95eedbfe9bece52bf5bdc5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a35053dd6b939f8d9e170b46f53dd4206da004360d95eedbfe9bece52bf5bdc5.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
njrat
im523
HacKed
0.tcp.eu.ngrok.io:10543
0f26a0177e6d7bdea303c415a2cd31ad
-
reg_key
0f26a0177e6d7bdea303c415a2cd31ad
-
splitter
|'|'|
Targets
-
-
Target
a35053dd6b939f8d9e170b46f53dd4206da004360d95eedbfe9bece52bf5bdc5.exe
-
Size
37KB
-
MD5
04367c9726da6129021795592068378b
-
SHA1
ad27c15e09cc240c125604e3b01948f674be73f6
-
SHA256
a35053dd6b939f8d9e170b46f53dd4206da004360d95eedbfe9bece52bf5bdc5
-
SHA512
b970ef6e60394b32cecf0c9269377440557f9c8e42c5f26b7dace94fe3730dadff83113688e1085e170917743cc1ac6683ed2ebe101669598989b80afdd6252e
-
SSDEEP
384:/5knF7Lsikf9zNf/1uyU7nQ3H1smY32rAF+rMRTyN/0L+EcoinblneHQM3epzX2s:+nNal1lU7nQFNYmrM+rMRa8NuoEt
Score8/10-
Modifies Windows Firewall
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1