General
-
Target
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f
-
Size
23KB
-
Sample
220520-31stjacfhq
-
MD5
8f713ec1e198c1f3146670988a3143c9
-
SHA1
4a1cf100216e3a677b4e06e011adf1300213286b
-
SHA256
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f
-
SHA512
7f451161eeb7c0c5f61d2bd82bc026811c95030a022c3fbfa884f86e00332aee2fbc82a23ca398eb57a58311a55932ab32b98460fa2b806f93699763d1e5e929
Behavioral task
behavioral1
Sample
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
0.7d
HacKed
kryptokrypto123.ddns.net:5552
c6dfbab76abb2fb1938d3e35b1bb6f3a
-
reg_key
c6dfbab76abb2fb1938d3e35b1bb6f3a
-
splitter
|'|'|
Targets
-
-
Target
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f
-
Size
23KB
-
MD5
8f713ec1e198c1f3146670988a3143c9
-
SHA1
4a1cf100216e3a677b4e06e011adf1300213286b
-
SHA256
e9863244d1be98ec45377430e8d9f056e369677bd67649d59de9c9d1a669743f
-
SHA512
7f451161eeb7c0c5f61d2bd82bc026811c95030a022c3fbfa884f86e00332aee2fbc82a23ca398eb57a58311a55932ab32b98460fa2b806f93699763d1e5e929
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-