General
-
Target
H3RLtYJ1.exe
-
Size
32KB
-
Sample
201124-vkdhpa3mm6
-
MD5
2628f3eaa3b7aa3173e266eb448abf39
-
SHA1
c48a93e4c7216813c68616fe0a09d82200091b08
-
SHA256
868afd54df23222e69bebc2e0c6aa35c1133a283bd4ff77cbc7ffe7e575cf1ad
-
SHA512
dee26330968e1c90fe6f28374ebb0d5966b742750b0b7e6c8be96d951f6fc7b1ca7e4e26905ee4a511390e41d3bdf489501dd4eeaad1684e067ab24a344440fc
Static task
static1
Behavioral task
behavioral1
Sample
H3RLtYJ1.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
H3RLtYJ1.exe
Resource
win10v20201028
Malware Config
Extracted
njrat
좀비
4dffd0580f3903c3690a533f8a96d5f7
-
reg_key
4dffd0580f3903c3690a533f8a96d5f7
Targets
-
-
Target
H3RLtYJ1.exe
-
Size
32KB
-
MD5
2628f3eaa3b7aa3173e266eb448abf39
-
SHA1
c48a93e4c7216813c68616fe0a09d82200091b08
-
SHA256
868afd54df23222e69bebc2e0c6aa35c1133a283bd4ff77cbc7ffe7e575cf1ad
-
SHA512
dee26330968e1c90fe6f28374ebb0d5966b742750b0b7e6c8be96d951f6fc7b1ca7e4e26905ee4a511390e41d3bdf489501dd4eeaad1684e067ab24a344440fc
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-