Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 19:18
General
-
Target
кряк никсвар/nixwarecrack_26082024.exe
-
Size
43KB
-
MD5
afbfd995fcaa54e1595b086548fe09d3
-
SHA1
c94e3685fcc937da2e0ea49b99bec942f96e0346
-
SHA256
bd3c008458988fb2ef7f3f8d99bd306bfc1ebe2751e1e5a33f59fc7878707c9f
-
SHA512
3007b31abf20e99b90e0c96007a2ba1e33b499e7cd263ec464816f040a671264d24768df090ecd8f550cfc84a61a794a795220337c299033ece5a1b267b72707
-
SSDEEP
768:pvA2QOuJcRvIl7abYg/sVUMTcSFCRK7j9U6xmZxiX8kkl9U2kSfaK0JZ:OhBCIl7abBs2M4OCRK7jCAilu2kmiZ
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Platinum
Botnet
test
C2
127.0.0.1:8085
Mutex
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\кряк никсвар\nixwarecrack_26082024.exe"C:\Users\Admin\AppData\Local\Temp\кряк никсвар\nixwarecrack_26082024.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
88KB
-
Filesize
664KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB