General
-
Target
HEUR-Trojan.Win32.Generic-0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
-
Size
37KB
-
Sample
220922-v91xhafhar
-
MD5
8eedc01c11b251481dec59e5308dccc3
-
SHA1
24bf069e9f2a1f12aefa391674ed82059386b0aa
-
SHA256
0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d
-
SHA512
52388313b21f14aa69c8b37e0fe0b73f66aa92f08651a16c820aae65d341dc1af6b48f3c8d4f657ac990eeaf4b9a01ae769bca4d3625550011708697d22b69cc
-
SSDEEP
384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Generic-0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.Generic-0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
im523
mediaget
kazya1.hopto.org:1470
a797c6ca3f5e7aff8fa1149c47fe9466
-
reg_key
a797c6ca3f5e7aff8fa1149c47fe9466
-
splitter
|'|'|
Targets
-
-
Target
HEUR-Trojan.Win32.Generic-0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
-
Size
37KB
-
MD5
8eedc01c11b251481dec59e5308dccc3
-
SHA1
24bf069e9f2a1f12aefa391674ed82059386b0aa
-
SHA256
0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d
-
SHA512
52388313b21f14aa69c8b37e0fe0b73f66aa92f08651a16c820aae65d341dc1af6b48f3c8d4f657ac990eeaf4b9a01ae769bca4d3625550011708697d22b69cc
-
SSDEEP
384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-