General
- Target Server.exe
- Size 23KB
- Sample260901-ssbvya1frb
- SHA256 a756c85995e6a3fd777fd402042a7ae5d90c333fa7958d192f66a55a49184d73
- MD5 407353ccfc62d571600dff09d43a5301
- SHA1 9661dc5f91196d601bd33edde519a4db16e287fe
- SHA512 ec12182c72e89f3b8ff92abce3bb48eaa7577c63f869ff4f6dbf03468592b886a03c44a629cbd42d4869ad2baf7c8f0bfc990ff1039da7bf96d66f9e0a1f3b20
- SSDEEP 384:Cc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZ6Y:w873kgNfoaf6ARpcnuQ
- TLSH T11BB22A4E3FA98856C56C177496B59A5003B4D1870423EE2FCDC560CBAFB3AD92D4CAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
1
C2
-
127.0.0.1:5552
Mutex
-
6eaf623464f5e183607e84ee934ef0ec
Attributes
-
reg_key
6eaf623464f5e183607e84ee934ef0ec
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 23KB
- SHA256 a756c85995e6a3fd777fd402042a7ae5d90c333fa7958d192f66a55a49184d73
- MD5 407353ccfc62d571600dff09d43a5301
- SHA1 9661dc5f91196d601bd33edde519a4db16e287fe
- SHA512 ec12182c72e89f3b8ff92abce3bb48eaa7577c63f869ff4f6dbf03468592b886a03c44a629cbd42d4869ad2baf7c8f0bfc990ff1039da7bf96d66f9e0a1f3b20
- SSDEEP 384:Cc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZ6Y:w873kgNfoaf6ARpcnuQ
- TLSH T11BB22A4E3FA98856C56C177496B59A5003B4D1870423EE2FCDC560CBAFB3AD92D4CAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1