General
-
Target
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225
-
Size
29KB
-
Sample
221003-rqzcsabaaj
-
MD5
55fd93a0b2fdc1e01a44ae3614327d60
-
SHA1
ab2455eb18482c3df5f25b572862a843c4331e47
-
SHA256
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225
-
SHA512
d46d18fad3819462561aa0b9cdf6542369c273af356a66c8f1b2744695b8d51dbbbbb69cc94fd6ab0e3813cd48c4f890d00e20c9b99e802ea22ad32a2a4fb934
-
SSDEEP
768:drD71oGc1FRVp74q8HesBKh0p29SgRpm:ND71IPkpZKhG29jpm
Behavioral task
behavioral1
Sample
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.6.4
HacKed
zahro2013.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225
-
Size
29KB
-
MD5
55fd93a0b2fdc1e01a44ae3614327d60
-
SHA1
ab2455eb18482c3df5f25b572862a843c4331e47
-
SHA256
6c6185a8f013c4a2044d5090d376b4d28fa2b5122833e142b4e929ada735b225
-
SHA512
d46d18fad3819462561aa0b9cdf6542369c273af356a66c8f1b2744695b8d51dbbbbb69cc94fd6ab0e3813cd48c4f890d00e20c9b99e802ea22ad32a2a4fb934
-
SSDEEP
768:drD71oGc1FRVp74q8HesBKh0p29SgRpm:ND71IPkpZKhG29jpm
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-