General
-
Target
35329cdc7dc585785684a6ceb65278b1.exe
-
Size
37KB
-
Sample
220905-pl731sghbp
-
MD5
35329cdc7dc585785684a6ceb65278b1
-
SHA1
f154f7b937ed9b4f6738703f3a3e9ea0350fb806
-
SHA256
571b1ab166e73a7e33e5cf8b9f9c9e3a055b11205394a7395b7775f49dd76d66
-
SHA512
3c278efd08276780388893b9d823841531ff136ce21e6e9fad2c229f14d6af92c5007113ae4ebdbfa32fb567df059816b6c84420fa19d9309bc3373e9b16db33
-
SSDEEP
384:unu1HCiMT3jBVbJsy8PVAbAoJvzv7QyYdSrAF+rMRTyN/0L+EcoinblneHQM3epz:uhbJP8PVsAafVY0rM+rMRa8NuICt
Behavioral task
behavioral1
Sample
35329cdc7dc585785684a6ceb65278b1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35329cdc7dc585785684a6ceb65278b1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
im523
HACK
journal-serial.at.playit.gg:59826
6b15523b39e3dae4db6cae2a109d2d5f
-
reg_key
6b15523b39e3dae4db6cae2a109d2d5f
-
splitter
|'|'|
Targets
-
-
Target
35329cdc7dc585785684a6ceb65278b1.exe
-
Size
37KB
-
MD5
35329cdc7dc585785684a6ceb65278b1
-
SHA1
f154f7b937ed9b4f6738703f3a3e9ea0350fb806
-
SHA256
571b1ab166e73a7e33e5cf8b9f9c9e3a055b11205394a7395b7775f49dd76d66
-
SHA512
3c278efd08276780388893b9d823841531ff136ce21e6e9fad2c229f14d6af92c5007113ae4ebdbfa32fb567df059816b6c84420fa19d9309bc3373e9b16db33
-
SSDEEP
384:unu1HCiMT3jBVbJsy8PVAbAoJvzv7QyYdSrAF+rMRTyN/0L+EcoinblneHQM3epz:uhbJP8PVsAafVY0rM+rMRa8NuICt
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-