General
-
Target
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
-
Size
43KB
-
Sample
220520-wj98xsbcg4
-
MD5
358ae564587620cc34b0a18ac5519f6c
-
SHA1
39885cfae334c24e282be860c1a5653bd0215199
-
SHA256
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
-
SHA512
48754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
Behavioral task
behavioral1
Sample
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
123456789gg.ddns.net:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
-
Size
43KB
-
MD5
358ae564587620cc34b0a18ac5519f6c
-
SHA1
39885cfae334c24e282be860c1a5653bd0215199
-
SHA256
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
-
SHA512
48754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-