General
-
Target
HEUR-Trojan.MSIL.Gorgon.gen-4c9b1b4db3fd9b0cd.exe
-
Size
275KB
-
Sample
220913-sa124sfhc2
-
MD5
23fa40a66b8c641f8324c2b659c341be
-
SHA1
8eeea57eb2af7bb571f023b29d59202e97eaab59
-
SHA256
4c9b1b4db3fd9b0cd9b7163cdbee3c321cd2046516f65443345d34eeaba05b05
-
SHA512
ad47eb6357936125ebb8d10a1dea5c42357178fc0e7243adf50a4a9677fb78ca49912fae43d0a0f86cdc0c1215a43dd60f194f7ebcd5cea9ad438d8f5f8eea58
-
SSDEEP
3072:UYH88y9uczJx44Dolo4fFSpTjP17qWyW3zbx2vyE7S1M2Q:Ply9uczJxRDolZgV1dnbkORQ
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Gorgon.gen-4c9b1b4db3fd9b0cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.MSIL.Gorgon.gen-4c9b1b4db3fd9b0cd.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
2.tcp.eu.ngrok.io:13002
2806cdb1ef67986308064d5873a67ad7
-
reg_key
2806cdb1ef67986308064d5873a67ad7
-
splitter
|'|'|
Targets
-
-
Target
HEUR-Trojan.MSIL.Gorgon.gen-4c9b1b4db3fd9b0cd.exe
-
Size
275KB
-
MD5
23fa40a66b8c641f8324c2b659c341be
-
SHA1
8eeea57eb2af7bb571f023b29d59202e97eaab59
-
SHA256
4c9b1b4db3fd9b0cd9b7163cdbee3c321cd2046516f65443345d34eeaba05b05
-
SHA512
ad47eb6357936125ebb8d10a1dea5c42357178fc0e7243adf50a4a9677fb78ca49912fae43d0a0f86cdc0c1215a43dd60f194f7ebcd5cea9ad438d8f5f8eea58
-
SSDEEP
3072:UYH88y9uczJx44Dolo4fFSpTjP17qWyW3zbx2vyE7S1M2Q:Ply9uczJxRDolZgV1dnbkORQ
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-