General
-
Target
a3a468c4b0640c15aee01c2badcd3a85.exe
-
Size
23KB
-
Sample
220823-1qgmeadbg4
-
MD5
a3a468c4b0640c15aee01c2badcd3a85
-
SHA1
2f655452ed069f4a1e5c60a10859ee4211528738
-
SHA256
e3dcfe8e87c93aeb13b2321cfcf1589dd281e9e6df9f6bf38e7effaaedcf9afb
-
SHA512
35804386ba45e88bc8d0f99656d919f9be8c2a7039aabf610f4ec8876f0e6f14ccb37ff6a181ea73045db94355e994aadb34bb5fd1c2cbdc298c2844b8738a51
-
SSDEEP
384:BEQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZEu:JOaxVULRpcnu4
Behavioral task
behavioral1
Sample
a3a468c4b0640c15aee01c2badcd3a85.exe
Resource
win7-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
davizshadow.duckdns.org:10006
5416181d1aed2d5b4e6657614271df58
-
reg_key
5416181d1aed2d5b4e6657614271df58
-
splitter
|'|'|
Targets
-
-
Target
a3a468c4b0640c15aee01c2badcd3a85.exe
-
Size
23KB
-
MD5
a3a468c4b0640c15aee01c2badcd3a85
-
SHA1
2f655452ed069f4a1e5c60a10859ee4211528738
-
SHA256
e3dcfe8e87c93aeb13b2321cfcf1589dd281e9e6df9f6bf38e7effaaedcf9afb
-
SHA512
35804386ba45e88bc8d0f99656d919f9be8c2a7039aabf610f4ec8876f0e6f14ccb37ff6a181ea73045db94355e994aadb34bb5fd1c2cbdc298c2844b8738a51
-
SSDEEP
384:BEQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZEu:JOaxVULRpcnu4
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-