General
-
Target
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d
-
Size
93KB
-
Sample
220701-gqe9ssgfd8
-
MD5
e005b555ea05cef46b13fe5de4892ab9
-
SHA1
547a4b55fd055d5eaa69090da90f8d9bf58cd51c
-
SHA256
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d
-
SHA512
2731c12ffad3eb09151301d4d1fd3987b48df64ba7b9c55a80fcb8ce75eb0e9960eb1e7b1e010507d45a0f0bfd729fe08c43fbcd0de2345576110a01c291a4b8
Behavioral task
behavioral1
Sample
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
njrat
im523
jpeg
178.44.199.23:7777
f7637d68ce1b9405a0673e2492622992
-
reg_key
f7637d68ce1b9405a0673e2492622992
-
splitter
|'|'|
Targets
-
-
Target
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d
-
Size
93KB
-
MD5
e005b555ea05cef46b13fe5de4892ab9
-
SHA1
547a4b55fd055d5eaa69090da90f8d9bf58cd51c
-
SHA256
8d922558add2ca72d28ccf04735189741860cc38f9f6862a1a430314a814749d
-
SHA512
2731c12ffad3eb09151301d4d1fd3987b48df64ba7b9c55a80fcb8ce75eb0e9960eb1e7b1e010507d45a0f0bfd729fe08c43fbcd0de2345576110a01c291a4b8
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-