General
-
Target
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
-
Size
855KB
-
Sample
221014-k8vc8ahaa8
-
MD5
6aa1e096f657f2d549e67579d7edb490
-
SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c
-
SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
-
SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
SSDEEP
3072:15oQcAV8NrucfhvH8GLx99NhCHBd0vqV7S1zWnyzYmLZds2qHhHTYYzy6aWeTaAF:1uW
Static task
static1
Behavioral task
behavioral1
Sample
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.6.4
HacKed
mochakis.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
-
Size
855KB
-
MD5
6aa1e096f657f2d549e67579d7edb490
-
SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c
-
SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
-
SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
SSDEEP
3072:15oQcAV8NrucfhvH8GLx99NhCHBd0vqV7S1zWnyzYmLZds2qHhHTYYzy6aWeTaAF:1uW
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-