General
-
Target
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46
-
Size
83KB
-
Sample
221120-lt379agc99
-
MD5
19ab2fc47a795bcc8a2ff75ffb81f3c0
-
SHA1
bd3a8d9e48bc3953a5995b270be1e20e202cd09d
-
SHA256
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46
-
SHA512
ac01e8c2003641bebc9feb1633f10477c41944ab787809d826c395d419710e51f9527d7e8b25c837ccfcdf4dec86899595c1cd5e6999aab8fa6493ede5eb82af
-
SSDEEP
1536:IkTC5O7yf12f4UeQUumrDBVxk2P/wX8PMNCimIdvHZ9vi6u:IkTCVdzce+2PZExmivLvi6u
Static task
static1
Behavioral task
behavioral1
Sample
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
1
choukiba.no-ip.org:5552
d8692617e945f5bef6c8a7480b56b61e
-
reg_key
d8692617e945f5bef6c8a7480b56b61e
-
splitter
|'|'|
Targets
-
-
Target
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46
-
Size
83KB
-
MD5
19ab2fc47a795bcc8a2ff75ffb81f3c0
-
SHA1
bd3a8d9e48bc3953a5995b270be1e20e202cd09d
-
SHA256
4ef9b32300bc30dcfc914b1d5666884fe46c0713a3ca6cfc217e6d0307734a46
-
SHA512
ac01e8c2003641bebc9feb1633f10477c41944ab787809d826c395d419710e51f9527d7e8b25c837ccfcdf4dec86899595c1cd5e6999aab8fa6493ede5eb82af
-
SSDEEP
1536:IkTC5O7yf12f4UeQUumrDBVxk2P/wX8PMNCimIdvHZ9vi6u:IkTCVdzce+2PZExmivLvi6u
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-