Overview

overview

10

Static

static

10

sosi_biby.exe

windows7-x64

8

sosi_biby.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sosi_biby.exe

  • Size

    37KB

  • Sample

    241017-lnhz5avhrl

  • MD5

    e11aa2c789dfd4b10e77090c4c3e448f

  • SHA1

    ea62417c208415661cbcace3984f493f55eedaa8

  • SHA256

    61f6d97939e73cf2a5c172bd2a19ae50e5b4c76fb5426cb30d062e1a0bc5071d

  • SHA512

    17ce670b5a814a5181a74fee69dccd44bd0be55dc53650f0374e8bd503066a4eec10bfe503d3ad11ad845575ebb0bcb3fda2eaf23100aa8f6adc86677d33857f

  • SSDEEP

    384:fW/gUiDrblmJEpRGyEfdDPTuWCYqAlLrAF+rMRTyN/0L+EcoinblneHQM3epzX9J:e/yHpR9EfdDCWClAprM+rMRa8Nu/vzt

Score
10/10
njratnoobdiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

noob

C2

6.tcp.eu.ngrok.io:17297

Mutex

612b5654a765e68b788c9882725c66ac

Attributes
  • reg_key

    612b5654a765e68b788c9882725c66ac

  • splitter

    |'|'|

Targets

    • Target

      sosi_biby.exe

    • Size

      37KB

    • MD5

      e11aa2c789dfd4b10e77090c4c3e448f

    • SHA1

      ea62417c208415661cbcace3984f493f55eedaa8

    • SHA256

      61f6d97939e73cf2a5c172bd2a19ae50e5b4c76fb5426cb30d062e1a0bc5071d

    • SHA512

      17ce670b5a814a5181a74fee69dccd44bd0be55dc53650f0374e8bd503066a4eec10bfe503d3ad11ad845575ebb0bcb3fda2eaf23100aa8f6adc86677d33857f

    • SSDEEP

      384:fW/gUiDrblmJEpRGyEfdDPTuWCYqAlLrAF+rMRTyN/0L+EcoinblneHQM3epzX9J:e/yHpR9EfdDCWClAprM+rMRa8Nu/vzt

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks