General
-
Target
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a
-
Size
230KB
-
Sample
221003-cd89wsbdf8
-
MD5
0223f22a150419abfc822885f8fe31c0
-
SHA1
0b1cea6bdb5c43ab35185652d81aac92349eb90f
-
SHA256
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a
-
SHA512
779d04cc09d3eeda9e9ff2cf455657028739caaca5aeb2b00098fca24bc5d0f76b1d0b0321d8eb9fdd52dc5c83d940d5a230af79c0036daf80e7997fda0c6708
-
SSDEEP
6144:8dk+06UMEJfvPVUEPzzc29QSrs0lw8Aqu3Ql:88NWS3w8AL3Ql
Static task
static1
Behavioral task
behavioral1
Sample
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
jabr123jabr.myftp.org:1177
9c8cf16d14d1fa0fb840fb22d64f0bbe
-
reg_key
9c8cf16d14d1fa0fb840fb22d64f0bbe
-
splitter
|'|'|
Targets
-
-
Target
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a
-
Size
230KB
-
MD5
0223f22a150419abfc822885f8fe31c0
-
SHA1
0b1cea6bdb5c43ab35185652d81aac92349eb90f
-
SHA256
799d4d6bcf11e615a9d36efcb472f9030507f7b1910c4a19970796557985406a
-
SHA512
779d04cc09d3eeda9e9ff2cf455657028739caaca5aeb2b00098fca24bc5d0f76b1d0b0321d8eb9fdd52dc5c83d940d5a230af79c0036daf80e7997fda0c6708
-
SSDEEP
6144:8dk+06UMEJfvPVUEPzzc29QSrs0lw8Aqu3Ql:88NWS3w8AL3Ql
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-