Overview

overview

10

Static

static

10

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    93KB

  • Sample

    240425-dhbpvseb48

  • MD5

    c017d3353d03ae0b037ab02dd7ef7c70

  • SHA1

    2c4af4955f18a3fcfffd303dd3a49abd7fb501a4

  • SHA256

    de12a703ef8f0051da4be69f2e2566ab51ff74ed2d0d2a45be6f262a7b9749ea

  • SHA512

    75066de03ec5cff4553a1b81f4e7e5fe4aa6e7f526bf613701a66c488b65e43f6a7453189ddd1d129f132407295c3f939c1b808e123e80cecb0e0378c13721a6

  • SSDEEP

    768:dY3glnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3lsGj:PlxOx6baIa9RZj00ljEwzGi1dD1DngS

Score
10/10
njrathackedevasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:9876
Mutex

cfe2a791e730853e1c1ec30059157db0

Attributes
  • reg_key

    cfe2a791e730853e1c1ec30059157db0

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      93KB

    • MD5

      c017d3353d03ae0b037ab02dd7ef7c70

    • SHA1

      2c4af4955f18a3fcfffd303dd3a49abd7fb501a4

    • SHA256

      de12a703ef8f0051da4be69f2e2566ab51ff74ed2d0d2a45be6f262a7b9749ea

    • SHA512

      75066de03ec5cff4553a1b81f4e7e5fe4aa6e7f526bf613701a66c488b65e43f6a7453189ddd1d129f132407295c3f939c1b808e123e80cecb0e0378c13721a6

    • SSDEEP

      768:dY3glnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3lsGj:PlxOx6baIa9RZj00ljEwzGi1dD1DngS

    Score
    8/10
    evasion
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks