General
-
Target
aa652fc67ec4c4353b9a5562c9ec0d21
-
Size
816KB
-
Sample
210908-z2paysadbk
-
MD5
aa652fc67ec4c4353b9a5562c9ec0d21
-
SHA1
1dea45515e03d1f561e5a31a1859aea7aa05bd62
-
SHA256
ae4fdb69e4ef555cb516a8052d715d741ae565c97cc595f3ea0dc3cd349c4b8d
-
SHA512
eddb0fa378f4d4f9aa1ab0eee44705024e89d6bd2c09a313f60b2203f7cf52c2e66909154c4a176bf865da1c211ddcbe1d9b12224125e44eb6ee70e0c61e4e09
Static task
static1
Behavioral task
behavioral1
Sample
aa652fc67ec4c4353b9a5562c9ec0d21.exe
Resource
win7-en
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
gbarpresencewriterprint.duckdns.org:8651
682708ec68e74
-
reg_key
682708ec68e74
-
splitter
@!#&^%$
Targets
-
-
Target
aa652fc67ec4c4353b9a5562c9ec0d21
-
Size
816KB
-
MD5
aa652fc67ec4c4353b9a5562c9ec0d21
-
SHA1
1dea45515e03d1f561e5a31a1859aea7aa05bd62
-
SHA256
ae4fdb69e4ef555cb516a8052d715d741ae565c97cc595f3ea0dc3cd349c4b8d
-
SHA512
eddb0fa378f4d4f9aa1ab0eee44705024e89d6bd2c09a313f60b2203f7cf52c2e66909154c4a176bf865da1c211ddcbe1d9b12224125e44eb6ee70e0c61e4e09
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-