General
-
Target
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732
-
Size
281KB
-
Sample
221021-w2x2baabc7
-
MD5
188632a7cea8c8118ad0104f239feb00
-
SHA1
375d58d7ba6b77270a8e0591cb020496b98bd9b3
-
SHA256
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732
-
SHA512
2afddc5d63b173944715586e75549392300de501e979ec85a1bd813524a2fe227b332f9805843a58741a571d83f8220f931da1b866d393b2dbb863928b075cd5
-
SSDEEP
6144:jeN1Mlv+PCBovdXcOwMC5b6oZQwcKl/D2:Ymlv+60MOw/5b6o9D
Static task
static1
Behavioral task
behavioral1
Sample
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
njrat
0.7d
1
127.0.0.1:5552
573e9338f958850d02c24ec1df24c0d6
-
reg_key
573e9338f958850d02c24ec1df24c0d6
-
splitter
|'|'|
Targets
-
-
Target
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732
-
Size
281KB
-
MD5
188632a7cea8c8118ad0104f239feb00
-
SHA1
375d58d7ba6b77270a8e0591cb020496b98bd9b3
-
SHA256
8e377dd50c38dce40877ff7a9a253a22337582f4de9e7a84f61abd1a73a88732
-
SHA512
2afddc5d63b173944715586e75549392300de501e979ec85a1bd813524a2fe227b332f9805843a58741a571d83f8220f931da1b866d393b2dbb863928b075cd5
-
SSDEEP
6144:jeN1Mlv+PCBovdXcOwMC5b6oZQwcKl/D2:Ymlv+60MOw/5b6o9D
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-