General
-
Target
bf01bd6b7f7aa984e24d4e1ad2bb56a422d7bf1f609256d5094020d8ff887dc8
-
Size
37KB
-
Sample
220520-1lvy8shbhr
-
MD5
d4ae130ffb524a176b0f218ec461a32f
-
SHA1
41fae0afe0d112bed49658f9bde1191e90990138
-
SHA256
bf01bd6b7f7aa984e24d4e1ad2bb56a422d7bf1f609256d5094020d8ff887dc8
-
SHA512
a0ca2ef49f25e713aa30d57ed3b2402bc399e2753c0942611613ff20ff96a44c38f641994d39b740bd5216201947f3a96459d52d8c1bc669bd0bbcd16ddeadfe
Behavioral task
behavioral1
Sample
bf01bd6b7f7aa984e24d4e1ad2bb56a422d7bf1f609256d5094020d8ff887dc8.exe
Resource
win7-20220414-en
Malware Config
Extracted
njrat
im523
KRIC
192.168.1.130:5552
cdffbb02e1916328f4aa20d5c638f039
-
reg_key
cdffbb02e1916328f4aa20d5c638f039
-
splitter
|'|'|
Targets
-
-
Target
bf01bd6b7f7aa984e24d4e1ad2bb56a422d7bf1f609256d5094020d8ff887dc8
-
Size
37KB
-
MD5
d4ae130ffb524a176b0f218ec461a32f
-
SHA1
41fae0afe0d112bed49658f9bde1191e90990138
-
SHA256
bf01bd6b7f7aa984e24d4e1ad2bb56a422d7bf1f609256d5094020d8ff887dc8
-
SHA512
a0ca2ef49f25e713aa30d57ed3b2402bc399e2753c0942611613ff20ff96a44c38f641994d39b740bd5216201947f3a96459d52d8c1bc669bd0bbcd16ddeadfe
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-