General
-
Target
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
-
Size
19KB
-
Sample
221001-zbmz7sfffj
-
MD5
7bfa508192c2639b347bd1c63e097cb0
-
SHA1
321a334588a603412ab81a33118f4a5ec89138e4
-
SHA256
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
-
SHA512
eda8f40b374ccd01cf698b9bfb317710be95f2de63987f61da39ac082ae3125afee9a1c33b204b3e2ab3e3c7e5cd1afea3a8859b7384817331a4960d9c9aad59
-
SSDEEP
384:HYSuWym/VaXoBqQLNHYA1kuhbGs1ABpp3GUD8eMcz2kmp:Hxx4XZ2H9TS3jWcz1mp
Static task
static1
Behavioral task
behavioral1
Sample
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.6.4
HacKed
hackali12121.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
-
Size
19KB
-
MD5
7bfa508192c2639b347bd1c63e097cb0
-
SHA1
321a334588a603412ab81a33118f4a5ec89138e4
-
SHA256
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
-
SHA512
eda8f40b374ccd01cf698b9bfb317710be95f2de63987f61da39ac082ae3125afee9a1c33b204b3e2ab3e3c7e5cd1afea3a8859b7384817331a4960d9c9aad59
-
SSDEEP
384:HYSuWym/VaXoBqQLNHYA1kuhbGs1ABpp3GUD8eMcz2kmp:Hxx4XZ2H9TS3jWcz1mp
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-