General
-
Target
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43
-
Size
43KB
-
Sample
220630-w2dbxahfc6
-
MD5
a5ba0a7d8bfd2ca07abc0a90914177c5
-
SHA1
56a7e7e22f3c4c42a6874a8c04193868e46444c3
-
SHA256
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43
-
SHA512
952720e613630838d58493205bc5e251cb9221c74ad9e9038f08ce9ce18a89f3dd853cc829254062686c706783aeaac181d738dfe706c587163d8afa903797fe
Behavioral task
behavioral1
Sample
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKid
thegoldfair01ifu8ck.hopto.org:7777
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43
-
Size
43KB
-
MD5
a5ba0a7d8bfd2ca07abc0a90914177c5
-
SHA1
56a7e7e22f3c4c42a6874a8c04193868e46444c3
-
SHA256
0829f2ad0073017c40930f11fdcb892b6dae92a8d207687128c4bb8a4eb0ab43
-
SHA512
952720e613630838d58493205bc5e251cb9221c74ad9e9038f08ce9ce18a89f3dd853cc829254062686c706783aeaac181d738dfe706c587163d8afa903797fe
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-