Overview

overview

10

Static

static

10

Server.exe

windows10-ltsc 2021-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    37KB

  • Sample

    250118-wk9zjs1lcl

  • MD5

    a404f1c74d62aa8505286bac745f65e8

  • SHA1

    583ec4674c5025734afc2e9f1981222797ea94d2

  • SHA256

    6fc5cf3fc04fa48f0052d3725ce6cc0b75a7d61e26bef113ee92b07c1dabc333

  • SHA512

    b6614f28ad19f3ebc68cba5da50cf7b30d5676798fca15ee8a112741adcf5c950ef5aa0f4ee17d2783d9f044cfdccc41988b1a6ece3f20073644b953929f835f

  • SSDEEP

    384:d36Nb7LsikZ9zNf/1uyU71evdjsOaP4rAF+rMRTyN/0L+EcoinblneHQM3epzXhb:ENf4l1lU71e9FagrM+rMRa8Nu+6t

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

black-associates.gl.at.ply.gg:40091

Mutex

37a1466afd082705c8e8913a15b7adae

Attributes
  • reg_key

    37a1466afd082705c8e8913a15b7adae

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      37KB

    • MD5

      a404f1c74d62aa8505286bac745f65e8

    • SHA1

      583ec4674c5025734afc2e9f1981222797ea94d2

    • SHA256

      6fc5cf3fc04fa48f0052d3725ce6cc0b75a7d61e26bef113ee92b07c1dabc333

    • SHA512

      b6614f28ad19f3ebc68cba5da50cf7b30d5676798fca15ee8a112741adcf5c950ef5aa0f4ee17d2783d9f044cfdccc41988b1a6ece3f20073644b953929f835f

    • SSDEEP

      384:d36Nb7LsikZ9zNf/1uyU71evdjsOaP4rAF+rMRTyN/0L+EcoinblneHQM3epzXhb:ENf4l1lU71e9FagrM+rMRa8Nu+6t

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks