General
-
Target
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9
-
Size
32KB
-
Sample
220520-2n46csagcl
-
MD5
a366a3b32e65335cf0f7a58e98ae18b2
-
SHA1
9a8a0ede01c7908e260e384fd41521b287e2971b
-
SHA256
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9
-
SHA512
2e88d9758316cea99159b5adb1386921d034c254db86f101538a8ef3c82ec9047db62a437b63cead10f23686308757edfd730a6e2bc82434b4e5d80d67b43916
Static task
static1
Behavioral task
behavioral1
Sample
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
138ffe906538d3e8fcc1b519e602532c
-
reg_key
138ffe906538d3e8fcc1b519e602532c
Targets
-
-
Target
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9
-
Size
32KB
-
MD5
a366a3b32e65335cf0f7a58e98ae18b2
-
SHA1
9a8a0ede01c7908e260e384fd41521b287e2971b
-
SHA256
4ed234eefd1e69a914451a569475764b47e7faac34a1c374e9697cf6bb2c4de9
-
SHA512
2e88d9758316cea99159b5adb1386921d034c254db86f101538a8ef3c82ec9047db62a437b63cead10f23686308757edfd730a6e2bc82434b4e5d80d67b43916
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-