Static task
static1
Behavioral task
behavioral1
Sample
6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
Resource
win10-en-20211208
General
-
Target
6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
-
Size
24.0MB
-
MD5
e11fa56349781d01080d0baba6367758
-
SHA1
6214bdca82fa0e54a75de181fd1ed95dffdaf35a
-
SHA256
6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929
-
SHA512
1e99d322bb33346db00d9ba4ac0a6deb19830b02d3d4f98aee5461b2bbf99d02831b1079daed9d44307c261084a6864a4242a352aa12590b265941002de65f64
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule sample disable_win_def -
Njrat family
Files
-
6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe.exe windows x86