General
-
Target
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d
-
Size
69KB
-
Sample
220528-cwlxbahddq
-
MD5
d88a7f3413515322025b9ebedeb64d9a
-
SHA1
2595386c3623224afe8ebfa37bae04cbe7a94e3d
-
SHA256
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d
-
SHA512
84983aa1fcd8befe05a924adc3d812602520929155fd4ec6ea3471b73dafafe78df0c72cad4e982889e1d280d2075fac5fd02d35ebea4ab8e5347616df692bdc
Static task
static1
Behavioral task
behavioral1
Sample
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
0.7d
Bot
socketw1.duckdns.org:8108
e031c5a7cf5b88cb0b44a56f08e29a21
-
reg_key
e031c5a7cf5b88cb0b44a56f08e29a21
-
splitter
|'|'|
Targets
-
-
Target
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d
-
Size
69KB
-
MD5
d88a7f3413515322025b9ebedeb64d9a
-
SHA1
2595386c3623224afe8ebfa37bae04cbe7a94e3d
-
SHA256
02e1fec4856b8cc2795a36e5d33a16faf6ac9a235c7c7317c2420254d1b2838d
-
SHA512
84983aa1fcd8befe05a924adc3d812602520929155fd4ec6ea3471b73dafafe78df0c72cad4e982889e1d280d2075fac5fd02d35ebea4ab8e5347616df692bdc
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-