General
- Target Server.exe
- Size 37KB
- Sample240723-wtak2svdqc
- SHA256 cbc68e15a092bc824408dd56e177de09359c330f90077ee3c7804db868812f2d
- MD5 75bdf785b37876ceea66d35e61af51bf
- SHA1 a08df5e69685eadde4277a5ad668577133dfdc80
- SHA512 2f7b356d0444d819ddb1d882b8df03d8bc22ae4be1d66cd14b590e699131a5b6f6f3f3ce5b5bf5f45bb6888d430a3f6e81908a5fdb28d42a3305c6d253ada711
- SSDEEP 384:336Nb7LsikZ9zNf/1uyU71evdjsOaP0rAF+rMRTyN/0L+EcoinblneHQM3epzXeR:aNf4l1lU71e9FacrM+rMRa8NuUoat
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10-20240404-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win7-20240708-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Server.exe
Resource
win10v2004-20240709-en
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Server.exe
Resource
win11-20240709-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
insurance-helmet.gl.at.ply.gg:31388
Mutex
-
68cf2f5e9f7c4ac831458909959b8c14
Attributes
-
reg_key
68cf2f5e9f7c4ac831458909959b8c14
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 37KB
- SHA256 cbc68e15a092bc824408dd56e177de09359c330f90077ee3c7804db868812f2d
- MD5 75bdf785b37876ceea66d35e61af51bf
- SHA1 a08df5e69685eadde4277a5ad668577133dfdc80
- SHA512 2f7b356d0444d819ddb1d882b8df03d8bc22ae4be1d66cd14b590e699131a5b6f6f3f3ce5b5bf5f45bb6888d430a3f6e81908a5fdb28d42a3305c6d253ada711
- SSDEEP 384:336Nb7LsikZ9zNf/1uyU71evdjsOaP0rAF+rMRTyN/0L+EcoinblneHQM3epzXeR:aNf4l1lU71e9FacrM+rMRa8NuUoat
- MD5 SHA1 SHA512 SSDEEP
-
Modifies Windows Firewall
MITRE ATT&CK Enterprise v15
Tasks
static1
hackednjrat
Score
10/10
behavioral1
discoveryevasionpersistenceprivilege_escalation
Score
8/10
behavioral2
discoveryevasionpersistenceprivilege_escalation
Score
8/10
behavioral3
discoveryevasionpersistenceprivilege_escalation
Score
8/10
behavioral4
discoveryevasionpersistenceprivilege_escalation
Score
8/10