General
-
Target
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99
-
Size
37KB
-
Sample
220520-1tvcnshean
-
MD5
da41705c070ddbe50b4774857de19a74
-
SHA1
8871c7ce68dde674da05339f3a6d6d0eefb0bcb0
-
SHA256
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99
-
SHA512
c1de464d1f2a3fb5bc95fb615f8909e8889383112691f10263d1bdf1aee94228c527d09caa195f6f40fe92e76cff0fb7eb679420390269e412f72143b0a30e9b
Static task
static1
Behavioral task
behavioral1
Sample
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
im523
79.140.166.40:22222
af7a25d12a577183bc6b99084bac0e73
-
reg_key
af7a25d12a577183bc6b99084bac0e73
-
splitter
|'|'|
Targets
-
-
Target
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99
-
Size
37KB
-
MD5
da41705c070ddbe50b4774857de19a74
-
SHA1
8871c7ce68dde674da05339f3a6d6d0eefb0bcb0
-
SHA256
3c3a76b613083c05bb7db61c6b359870c2e90352076f2d32a9c96061494bab99
-
SHA512
c1de464d1f2a3fb5bc95fb615f8909e8889383112691f10263d1bdf1aee94228c527d09caa195f6f40fe92e76cff0fb7eb679420390269e412f72143b0a30e9b
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-