Overview

overview

10

Static

static

10

Server.exe

windows7-x64

8

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    93KB

  • Sample

    241223-me8d4ayket

  • MD5

    f85380ea6dac746019c57488ec049cab

  • SHA1

    d35425d99af6d4022996c914775a3f100ef3caa8

  • SHA256

    fe1815f2fd1f865b00d83a777d5e7b69844bc342fd323118e904269d1a1bcb87

  • SHA512

    041374bd5eb0f06d93d697cd5e9775827b7fffee27b1f69de717b544097a8ad8325a39b9f80b4ceec0c5f5067dbbba06f7f19ba5158ca7098399cc41070c98ed

  • SSDEEP

    1536:RdwC+xhUa9urgOBPRNvM4jEwzGi1dDlDWgS:RdmUa9urgObdGi1dZ7

Score
10/10
njratfuckeddiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

fucked

C2

hakim32.ddns.net:2000

fat-pads.gl.at.ply.gg:35059
Mutex

1ded3b4c35b07f633f7f88a8380c030d

Attributes
  • reg_key

    1ded3b4c35b07f633f7f88a8380c030d

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      93KB

    • MD5

      f85380ea6dac746019c57488ec049cab

    • SHA1

      d35425d99af6d4022996c914775a3f100ef3caa8

    • SHA256

      fe1815f2fd1f865b00d83a777d5e7b69844bc342fd323118e904269d1a1bcb87

    • SHA512

      041374bd5eb0f06d93d697cd5e9775827b7fffee27b1f69de717b544097a8ad8325a39b9f80b4ceec0c5f5067dbbba06f7f19ba5158ca7098399cc41070c98ed

    • SSDEEP

      1536:RdwC+xhUa9urgOBPRNvM4jEwzGi1dDlDWgS:RdmUa9urgObdGi1dZ7

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks