Overview

overview

10

Static

static

10

Server.exe

windows7-x64

8

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    93KB

  • Sample

    250121-h6nfsasngk

  • MD5

    d61b6c8d2031c9c14fd2ca8cac4abbd0

  • SHA1

    232a655eb7c720a90d30f4f51a3aa4fde319be2b

  • SHA256

    c50c74721a340dfa457152405bb9fcf9bdd725b321510f8eaf2b23c4a68a6abb

  • SHA512

    4649981329ec72d555af8888b3bc2b6e93d3569c232247f430147aa32b8f907dc7f1e188f3ec32c5a33fa95cf06f8c3719da033959cb1af709ab4e133a2b3e3a

  • SSDEEP

    1536:1emC+xhUa9urgOB9RNvM4jEwzGi1dDlDRgS:1egUa9urgONdGi1dRO

Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

2.tcp.eu.ngrok.io:17881
Mutex

a5ecb8dd72f32c83945d9630db93a6c0

Attributes
  • reg_key

    a5ecb8dd72f32c83945d9630db93a6c0

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      93KB

    • MD5

      d61b6c8d2031c9c14fd2ca8cac4abbd0

    • SHA1

      232a655eb7c720a90d30f4f51a3aa4fde319be2b

    • SHA256

      c50c74721a340dfa457152405bb9fcf9bdd725b321510f8eaf2b23c4a68a6abb

    • SHA512

      4649981329ec72d555af8888b3bc2b6e93d3569c232247f430147aa32b8f907dc7f1e188f3ec32c5a33fa95cf06f8c3719da033959cb1af709ab4e133a2b3e3a

    • SSDEEP

      1536:1emC+xhUa9urgOB9RNvM4jEwzGi1dDlDRgS:1egUa9urgONdGi1dRO

    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Disables Task Manager via registry modification

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks