General
- Target Server.exe
- Size 37KB
- Sample260926-khv7tsyerf
- SHA256 79c9c022e8287be6c261be3afd3ebb6721f065dd4733bc883d593ffe183f44e2
- MD5 5d163fb2f35666db995d2f80bcba33c9
- SHA1 77b86bb4e0e36180a13b8f791f5f32994d89c020
- SHA512 432d9097e0a247a1476cd6cd699bbe6db70016fb8faffa63660abff42d0e390532efea2d25ff990a5bbad7645b0cd9eb5995d82553b1acaf0c565fd51290f992
- SSDEEP 384:uaqBkiyjnDNGRn5IyUvapIrPbh+/VsIt6crAF+rMRTyN/0L+EcoinblneHQM3epc:j35M5jUvairANsIQcrM+rMRa8NuT9Et
- TLSH T1DD032A4D7FE18168C5FD1A7B05B2D41207BAE04F6E23D90E8EE5649A37636C18F50AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
22.tcp.vip.cpolar.cn:11234
Mutex
-
d998446516f5332ff4fed41a20848fd2
Attributes
-
reg_key
d998446516f5332ff4fed41a20848fd2
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 37KB
- SHA256 79c9c022e8287be6c261be3afd3ebb6721f065dd4733bc883d593ffe183f44e2
- MD5 5d163fb2f35666db995d2f80bcba33c9
- SHA1 77b86bb4e0e36180a13b8f791f5f32994d89c020
- SHA512 432d9097e0a247a1476cd6cd699bbe6db70016fb8faffa63660abff42d0e390532efea2d25ff990a5bbad7645b0cd9eb5995d82553b1acaf0c565fd51290f992
- SSDEEP 384:uaqBkiyjnDNGRn5IyUvapIrPbh+/VsIt6crAF+rMRTyN/0L+EcoinblneHQM3epc:j35M5jUvairANsIQcrM+rMRa8NuT9Et
- TLSH T1DD032A4D7FE18168C5FD1A7B05B2D41207BAE04F6E23D90E8EE5649A37636C18F50AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1