Overview

overview

10

Static

static

10

620a8ee583...b2.exe

windows7-x64

8

620a8ee583...b2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0647d85ad26dd42f69aeae272251355a.bin

  • Size

    16KB

  • Sample

    240908-bcvvfavfmn

  • MD5

    071385e7a63c4a2b2d013446f6e46dcc

  • SHA1

    ac5467854ba97079e78ed28c8b416d744c4b25ad

  • SHA256

    77b692233f1784d9f726a9329413e39c8859bc614edc410c2498d5a7c3ac0c64

  • SHA512

    ebd6bc767b67bd8b99b6a3e04232b8a537e14043aac1a066dfd737919901533d3d82aac9031edfebc2b2ce5a3de638ee73d413114aa601500a29d95f90d518d9

  • SSDEEP

    384:cHKxta538CjOlKPQg7CR/hQcjajm1XJc4HoEbdlW6Ih6Ig12CR03/eaE:wKxI53bOlKogm/hQcjaUm4Hp5lWN4J1l

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:13886

Mutex

1cfc3a4d79c70d0292d64e0bc7c3001d

Attributes
  • reg_key

    1cfc3a4d79c70d0292d64e0bc7c3001d

  • splitter

    |'|'|

Targets

    • Target

      620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2.exe

    • Size

      37KB

    • MD5

      0647d85ad26dd42f69aeae272251355a

    • SHA1

      c05ae179575df57a7e0e7376749056a3fad67643

    • SHA256

      620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2

    • SHA512

      201cdc050b4c0f92c78181aa78b58ff816f344abd746c3ebd79b49518b7e15b3a6d54b34c1c495a51c0fc72f0d8f5003dfc4e576a0cef333a5bce7be410708a3

    • SSDEEP

      384:3mOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3M:NFdGdkrgYRwWS9rM+rMRa8NuiSt

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks