General
-
Target
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6
-
Size
37KB
-
Sample
220724-vtepbscchq
-
MD5
4cf563315a9a55d3897671a3332fc478
-
SHA1
fe4d382f2717b6c6d986e63c4e9342ee3e71fa78
-
SHA256
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6
-
SHA512
86ed3f08a9749aedb4e9ccca275b2db0e47509ec1cb24fe100cede2e08175f8b3b8dcd269832b963afa974b53be4e36e11908722b4bfb71e836755c4eac5a32e
Behavioral task
behavioral1
Sample
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
njrat
im523
hacker
hacker228.ddns.net:7777
d65b7ae301f2c83d267d8f3480777d2e
-
reg_key
d65b7ae301f2c83d267d8f3480777d2e
-
splitter
|'|'|
Targets
-
-
Target
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6
-
Size
37KB
-
MD5
4cf563315a9a55d3897671a3332fc478
-
SHA1
fe4d382f2717b6c6d986e63c4e9342ee3e71fa78
-
SHA256
e0d46a4f7b04a91e36a098a133afb99415994a2d62fb4b153a5a51991a6952c6
-
SHA512
86ed3f08a9749aedb4e9ccca275b2db0e47509ec1cb24fe100cede2e08175f8b3b8dcd269832b963afa974b53be4e36e11908722b4bfb71e836755c4eac5a32e
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-