General
- Target Server.exe
- Size 23KB
- Sample260802-gk1csadh76
- SHA256 867120f3252bdce7cbb9b9a9b16bcdd795e0626d104d6740b34d96c6d5166323
- MD5 57e141f717aabb15a2562d04aa066900
- SHA1 b0efc343c3edbe1049eec583bee5968e9b3d6d6f
- SHA512 0376932a11f88b6be1b6b571d56bd3c1993222a1545cba0229190a5c45d6647c7cbcd73e47f6baaccb82d4e7b32a798f240a59bab329f85727d582efa8e8b858
- SSDEEP 384:z+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZTvty:Mm+71d5XRpcnuIc
- TLSH T195B22A4E3FB98856C4BC177486A6965003B0A1470413EE2FCDC554DBAFB3AD92D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral3
Sample
Server.exe
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
Server.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
njrat
-
0.7d
-
HacKed
-
24.tcp.cpolar.top:10236
-
0237dc3e7dcefa6aefa82bdf90259f2e
-
reg_key
0237dc3e7dcefa6aefa82bdf90259f2e
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 23KB
- SHA256 867120f3252bdce7cbb9b9a9b16bcdd795e0626d104d6740b34d96c6d5166323
- MD5 57e141f717aabb15a2562d04aa066900
- SHA1 b0efc343c3edbe1049eec583bee5968e9b3d6d6f
- SHA512 0376932a11f88b6be1b6b571d56bd3c1993222a1545cba0229190a5c45d6647c7cbcd73e47f6baaccb82d4e7b32a798f240a59bab329f85727d582efa8e8b858
- SSDEEP 384:z+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZTvty:Mm+71d5XRpcnuIc
- TLSH T195B22A4E3FB98856C4BC177486A6965003B0A1470413EE2FCDC554DBAFB3AD92D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1