General
-
Target
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d
-
Size
122KB
-
Sample
220512-sv57kadaaq
-
MD5
977a90e9197fcbe2c5a04d3af4104a0f
-
SHA1
58775d091c45e3a3d39116e3e529a54c05f4f1ea
-
SHA256
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d
-
SHA512
963f6be0a843f48430aea9d97ff94a8228eb2855bd5a27122f4cf79bb2a29bda5000f838e94a1cbdaf52660500154ad96bb6a85921fae7dbe535908ac4b7ae99
Static task
static1
Behavioral task
behavioral1
Sample
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
0.7d
Hacked By HiDDen PerSOn
112.154.163.88:5229
ffb49a57bc292c1e8a2ee1eeb03a3e83
-
reg_key
ffb49a57bc292c1e8a2ee1eeb03a3e83
-
splitter
|'|'|
Targets
-
-
Target
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d
-
Size
122KB
-
MD5
977a90e9197fcbe2c5a04d3af4104a0f
-
SHA1
58775d091c45e3a3d39116e3e529a54c05f4f1ea
-
SHA256
99d052fadd8fa37b5642dbd4c42f3e5c061aafc8e894ba7a0fc73f3fe5a6b09d
-
SHA512
963f6be0a843f48430aea9d97ff94a8228eb2855bd5a27122f4cf79bb2a29bda5000f838e94a1cbdaf52660500154ad96bb6a85921fae7dbe535908ac4b7ae99
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-