General
-
Target
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498
-
Size
32KB
-
Sample
220520-e469bsaad8
-
MD5
6f8c33b0cffaf0c6659b1c5fcebe92d7
-
SHA1
d32cf3f25fc0cdd81721173c807a41331b60ab3c
-
SHA256
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498
-
SHA512
b510bf6813ee0d82b0a2d3cb26bc36f24dddf1075c5c1540928b35f1acef34353bfa10c41db2872c2d037bee4c8e6a00e02fb67ae6f77432e0a571e53d26e3e5
Static task
static1
Behavioral task
behavioral1
Sample
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
d3b66808f83d1cd8e254b0e5a9089197
-
reg_key
d3b66808f83d1cd8e254b0e5a9089197
Targets
-
-
Target
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498
-
Size
32KB
-
MD5
6f8c33b0cffaf0c6659b1c5fcebe92d7
-
SHA1
d32cf3f25fc0cdd81721173c807a41331b60ab3c
-
SHA256
5c5da6f1d6d73d51d7c720e5c470c8ef4e2da2d5195e372215b6ba4c41aab498
-
SHA512
b510bf6813ee0d82b0a2d3cb26bc36f24dddf1075c5c1540928b35f1acef34353bfa10c41db2872c2d037bee4c8e6a00e02fb67ae6f77432e0a571e53d26e3e5
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-