General
-
Target
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21
-
Size
3.3MB
-
Sample
220326-wy65taccdk
-
MD5
b25bb6011cd77d3d3b9c9ee6b18c3b06
-
SHA1
7da0bcdf76f7e355f7204eb1c9fc85cb0d970bf1
-
SHA256
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21
-
SHA512
5f67990c474f09d84443f8bd395bb87437e7dbe9906bbe8b38e4b9dd5a5c132cf40bc05d43325dc27de7da558fa470364187f2e572dc46116c828fdea7d22570
Static task
static1
Behavioral task
behavioral1
Sample
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
njrat
im523
system
192.168.56.1:1414
f5f77609bd30b7a81be16e78606bcee3
-
reg_key
f5f77609bd30b7a81be16e78606bcee3
-
splitter
|'|'|
Targets
-
-
Target
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21
-
Size
3.3MB
-
MD5
b25bb6011cd77d3d3b9c9ee6b18c3b06
-
SHA1
7da0bcdf76f7e355f7204eb1c9fc85cb0d970bf1
-
SHA256
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21
-
SHA512
5f67990c474f09d84443f8bd395bb87437e7dbe9906bbe8b38e4b9dd5a5c132cf40bc05d43325dc27de7da558fa470364187f2e572dc46116c828fdea7d22570
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-