General
-
Target
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e
-
Size
37KB
-
Sample
220520-e1jzmahge8
-
MD5
8bb066ff7083b2d7dff1b8a1bb47aaf7
-
SHA1
de6c13af77a76a74f54943415efd1fced38a6cc7
-
SHA256
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e
-
SHA512
9d326eaf23156eade7327e9a164eef1d774594bd8db9cdebb1ab4230b9321dc0b170b40c9b3bb5ba3268923ef2abf6a0700d0ebe0a8326779b67281b6db9a2aa
Behavioral task
behavioral1
Sample
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
im523
HacKed
antoniocometa.ddns.net:1604
bf2b934adc039f6f0c2d9ed3e3473fdf
-
reg_key
bf2b934adc039f6f0c2d9ed3e3473fdf
-
splitter
|'|'|
Targets
-
-
Target
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e
-
Size
37KB
-
MD5
8bb066ff7083b2d7dff1b8a1bb47aaf7
-
SHA1
de6c13af77a76a74f54943415efd1fced38a6cc7
-
SHA256
8835ec76c748d7b3c28135d15c6d9b26028c06ca2daf6086a355f8ac1007a08e
-
SHA512
9d326eaf23156eade7327e9a164eef1d774594bd8db9cdebb1ab4230b9321dc0b170b40c9b3bb5ba3268923ef2abf6a0700d0ebe0a8326779b67281b6db9a2aa
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-