General
-
Target
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243
-
Size
29KB
-
Sample
221014-h893kaddd9
-
MD5
60b48f498c0c261fd1379f926ea8fd40
-
SHA1
88e2513652af14b460bf0678c0363913ca59e509
-
SHA256
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243
-
SHA512
a1343a7d460321ceebdd10937fc5422a88741a6465139b5ed55dfa1f29825693338872782ba74d558af210a69e786d8d18e634ed03b46cb8571f1d6ccc58d2f5
-
SSDEEP
384:hFUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzQN:h57bUw2C3kEcqNreHBKh0p29SgR4bL1
Behavioral task
behavioral1
Sample
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.6.4
chrome
fade-2e7.no-ip.biz:1177
d5a38e9b5f206c41f8851bf04a251d26
-
reg_key
d5a38e9b5f206c41f8851bf04a251d26
-
splitter
|'|'|
Targets
-
-
Target
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243
-
Size
29KB
-
MD5
60b48f498c0c261fd1379f926ea8fd40
-
SHA1
88e2513652af14b460bf0678c0363913ca59e509
-
SHA256
9ea12a7d23cbc79094dd01aede5b3dd5b604cab08a70c16effeb1ca525609243
-
SHA512
a1343a7d460321ceebdd10937fc5422a88741a6465139b5ed55dfa1f29825693338872782ba74d558af210a69e786d8d18e634ed03b46cb8571f1d6ccc58d2f5
-
SSDEEP
384:hFUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzQN:h57bUw2C3kEcqNreHBKh0p29SgR4bL1
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-