General
- Target Server.exe
- Size 37KB
- Sample260701-d2ekvsfv2t
- SHA256 905904c9eba8a60eb560d1d48c62be917ce9c64072a2727cbd6340e438db1cb0
- MD5 a1ddfd2f904651fa9ba5dc86e1609383
- SHA1 a082d9a52424f4e7411b7d3abf025de06f0a9121
- SHA512 eb2a0ef90bce4c6eda854eb2623d19d3364e503887e114d8f81efa4d79fb5ec56a18afc7d26361e4cd31f3d9d24e2706c967b8ff63a2902146c26f7385d7e66d
- SSDEEP 384:taDvkit2Zf5W9cTYXyc/lPM20zHFmnPushrAF+rMRTyN/0L+EcoinblneHQM3epM:8DqjjTYic/lkEPusrM+rMRa8NuSpt
- TLSH T1BC032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win11ltsc2024-20260629-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
155.117.183.181:2017
Mutex
-
7f17b610b84646a812ffba5fa871e451
Attributes
-
reg_key
7f17b610b84646a812ffba5fa871e451
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 37KB
- SHA256 905904c9eba8a60eb560d1d48c62be917ce9c64072a2727cbd6340e438db1cb0
- MD5 a1ddfd2f904651fa9ba5dc86e1609383
- SHA1 a082d9a52424f4e7411b7d3abf025de06f0a9121
- SHA512 eb2a0ef90bce4c6eda854eb2623d19d3364e503887e114d8f81efa4d79fb5ec56a18afc7d26361e4cd31f3d9d24e2706c967b8ff63a2902146c26f7385d7e66d
- SSDEEP 384:taDvkit2Zf5W9cTYXyc/lPM20zHFmnPushrAF+rMRTyN/0L+EcoinblneHQM3epM:8DqjjTYic/lkEPusrM+rMRa8NuSpt
- TLSH T1BC032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1