General
-
Target
c61afce2daf916aeb261e03521487710.exe
-
Size
27KB
-
Sample
220521-1tbkkagggn
-
MD5
c61afce2daf916aeb261e03521487710
-
SHA1
7e1d47a80effe4f3d291dae476af85ef025345c7
-
SHA256
2f9c604e41361ed9dcdc82e2cfbdc7979d4dcc99f548a548774f7d06acf4f5c7
-
SHA512
526f70732a75875b2992e338ae370959650bcbf67fb51f7fb95ad2605737a2bbd886aecde63f463bab9cdd0e7fa875b491314848b6b002cb63ebd3eb68a0569c
Static task
static1
Behavioral task
behavioral1
Sample
c61afce2daf916aeb261e03521487710.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c61afce2daf916aeb261e03521487710.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
v2.0
HacKed_NotFully
moneroman.ddns.net:1194
Windows
-
reg_key
Windows
-
splitter
|-F-|
Targets
-
-
Target
c61afce2daf916aeb261e03521487710.exe
-
Size
27KB
-
MD5
c61afce2daf916aeb261e03521487710
-
SHA1
7e1d47a80effe4f3d291dae476af85ef025345c7
-
SHA256
2f9c604e41361ed9dcdc82e2cfbdc7979d4dcc99f548a548774f7d06acf4f5c7
-
SHA512
526f70732a75875b2992e338ae370959650bcbf67fb51f7fb95ad2605737a2bbd886aecde63f463bab9cdd0e7fa875b491314848b6b002cb63ebd3eb68a0569c
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-