General
-
Target
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677
-
Size
33KB
-
Sample
221001-2vq73sahe9
-
MD5
6fbbf6accff050bb1ea7cb45d4d68490
-
SHA1
8735565a7c7fb6c7dcc30d00c865d153965fd0c9
-
SHA256
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677
-
SHA512
8d2e87864d5850d86eb8dc9c23f0ee95c4b1103f9529bbb9d944ea7995d10a7c07605a1e7a836cdcd33c974ba768beac4c5fa66986f56fc93b259f521c59c61b
-
SSDEEP
768:71Y8OVaUnQ1Y8sEpKoCvutBW5dO7H1S8Mo/LYvl:u8tUnQ17uutBWj6H0iYd
Static task
static1
Behavioral task
behavioral1
Sample
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
ffgga.ddns.net:5552
341703a1cce6a06cd235f6c59cfda95c
-
reg_key
341703a1cce6a06cd235f6c59cfda95c
-
splitter
|'|'|
Targets
-
-
Target
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677
-
Size
33KB
-
MD5
6fbbf6accff050bb1ea7cb45d4d68490
-
SHA1
8735565a7c7fb6c7dcc30d00c865d153965fd0c9
-
SHA256
34603cc63fb50d77a917d3c7a784331f419a67f9655d2808b443c98e38092677
-
SHA512
8d2e87864d5850d86eb8dc9c23f0ee95c4b1103f9529bbb9d944ea7995d10a7c07605a1e7a836cdcd33c974ba768beac4c5fa66986f56fc93b259f521c59c61b
-
SSDEEP
768:71Y8OVaUnQ1Y8sEpKoCvutBW5dO7H1S8Mo/LYvl:u8tUnQ17uutBWj6H0iYd
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-