Overview

overview

10

Static

static

10

Server.exe

windows7-x64

8

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_51c93bc46142e2e719cd9696d66427992c8c39c400f361b0361a5e4ce70a2976

  • Size

    33KB

  • Sample

    241226-3sbkaavqgl

  • MD5

    0656121ab14c605153b81dcdc57b10b3

  • SHA1

    0fc1b20072e2784a65bc3398f3ca5460a6a65301

  • SHA256

    51c93bc46142e2e719cd9696d66427992c8c39c400f361b0361a5e4ce70a2976

  • SHA512

    2f953be5598e26636ad22e446505289d78fcccf5a279cd40b143619dbb1ad317522958f55b085a5a08eb0a83ed5df2675892de20ae909282b2af708ef826de5a

  • SSDEEP

    768:XnLWIfLxKvnHk8tEv7DfC7KiJqFN8gl6Hi:XSITxCHJOvXa9u8VC

Score
10/10
njratxddsdiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

xdds

C2

hakim32.ddns.net:2000

mean-territory.auto.playit.gg:50045
Mutex

ef639845e8835c28bb4b03f7f234b37a

Attributes
  • reg_key

    ef639845e8835c28bb4b03f7f234b37a

  • splitter

    |'|'|

Targets

    • Target

      Server.bin

    • Size

      93KB

    • MD5

      bac3c65b9f6c783c9e13fce59d20732c

    • SHA1

      b6e7fa7440ca9431e6d3d799a5451baeadc4f7b1

    • SHA256

      9b6c13d822606bdb533b624456a59ddf015789337e821b14b60241b872cecc99

    • SHA512

      af1b006ef3dac4df5b0b3ef25db03f768e21b40442e7cd672a2ce10fa221d09a6ec6c9493aa3dd8c3e41002f5aa83d4c2df05040095f2140cd560fb4afe4628a

    • SSDEEP

      1536:QI/r7EkrjaFIs7E5OxzJn8LjEwzGi1dDHDhgS:QI7jau5OVVni1dfe

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks