General
- Target Server.exe
- Size 93KB
- Sample260903-mg2pbsvcpf
- SHA256 686b49cfd9059086b3637259295108622d5eb226d9f34c3f9efe00e86aae19ba
- MD5 e69e6b927fa8f2dab91d4fc4146354e4
- SHA1 8ecbd1f777ac1007eab23270c2d87008e39385aa
- SHA512 16a7a400525b1bded342b7741ec4cb65e6bb40bb7bc5ab5a79a9787d3b598df4bafc5402bac8608fdb777a6ed1ba2831d41f226d37b738621f967cfa8fb3f1a4
- SSDEEP 768:CY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsGG:dUxOx6baIa9RZj00ljEwzGi1dDXDwgS
- TLSH T18093E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11-20260513-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
hakim32.ddns.net:2000
-
127.0.0.1:5552
Mutex
-
90cdc4299e3838b5249c33e1c7a2dd25
Attributes
-
reg_key
90cdc4299e3838b5249c33e1c7a2dd25
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 93KB
- SHA256 686b49cfd9059086b3637259295108622d5eb226d9f34c3f9efe00e86aae19ba
- MD5 e69e6b927fa8f2dab91d4fc4146354e4
- SHA1 8ecbd1f777ac1007eab23270c2d87008e39385aa
- SHA512 16a7a400525b1bded342b7741ec4cb65e6bb40bb7bc5ab5a79a9787d3b598df4bafc5402bac8608fdb777a6ed1ba2831d41f226d37b738621f967cfa8fb3f1a4
- SSDEEP 768:CY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsGG:dUxOx6baIa9RZj00ljEwzGi1dDXDwgS
- TLSH T18093E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1