Overview

overview

10

Static

static

10

New Client.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Client.exe

  • Size

    167KB

  • Sample

    241222-awmgqswmdm

  • MD5

    08c8b0a5d89a76d82087ea85f9c8ba03

  • SHA1

    7990fd4e83976009f0b5e3f78ada27405488c896

  • SHA256

    da14f3a37747b1623c51a34e6c7ceaa224b1fb6fac199753055dbb68cc898f8b

  • SHA512

    92ce62dd6a5ce72026b8eb51ee069dfcb7e477a9cf931863e430b124fb205dd5dce753d00b349e1a4f3b0f77a47c12f6b4bedd2fcd0f76cc468cd2d72b0e51f0

  • SSDEEP

    3072:lAMADoN36tnQviFCtABnGfWl9zqaF9bYYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:lpW9zvvM1/JdSI5eb

Score
10/10
njrathackeddiscoverypersistence

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:14324

Mutex

discord.exe

Attributes
  • reg_key

    discord.exe

  • splitter

    |Ghost|

Targets

    • Target

      New Client.exe

    • Size

      167KB

    • MD5

      08c8b0a5d89a76d82087ea85f9c8ba03

    • SHA1

      7990fd4e83976009f0b5e3f78ada27405488c896

    • SHA256

      da14f3a37747b1623c51a34e6c7ceaa224b1fb6fac199753055dbb68cc898f8b

    • SHA512

      92ce62dd6a5ce72026b8eb51ee069dfcb7e477a9cf931863e430b124fb205dd5dce753d00b349e1a4f3b0f77a47c12f6b4bedd2fcd0f76cc468cd2d72b0e51f0

    • SSDEEP

      3072:lAMADoN36tnQviFCtABnGfWl9zqaF9bYYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:lpW9zvvM1/JdSI5eb

    Score
    7/10
    discoverypersistence

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks