General
-
Target
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
-
Size
23KB
-
Sample
221003-a34dtsahfn
-
MD5
734a72fa06938e7beaed1e07c1508e20
-
SHA1
842062e2130b3a7cfa97124a9a18f6b35ffbdac5
-
SHA256
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
-
SHA512
3e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
SSDEEP
384:U8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZCF:zXcwt3tRpcnuV
Behavioral task
behavioral1
Sample
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:1337
5f76cab4062f3ff0306d0a613b00c588
-
reg_key
5f76cab4062f3ff0306d0a613b00c588
-
splitter
|'|'|
Targets
-
-
Target
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
-
Size
23KB
-
MD5
734a72fa06938e7beaed1e07c1508e20
-
SHA1
842062e2130b3a7cfa97124a9a18f6b35ffbdac5
-
SHA256
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
-
SHA512
3e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
SSDEEP
384:U8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZCF:zXcwt3tRpcnuV
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-