General
-
Target
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb
-
Size
204KB
-
Sample
221125-h7b45saf86
-
MD5
1de82b571fa4d2e2eecd41a2c5b02346
-
SHA1
df1c5c4a6cd3d4f3baea43997852299030a9fe25
-
SHA256
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb
-
SHA512
6b56ba4ed488197b727d76e36d8a9a7d5df96965d426dcf2bd6fee297001e83fbe016b833a1464c5b8901e747e1b69d2cb73cd817a22aa5abb0896f8fbe9c093
-
SSDEEP
3072:1weUySPS680++CZF8888yVQmqNWS/rkSWZPFE0QrQ3kce:1lUuZF8888yqhNZYSWZ9E0QrQB
Behavioral task
behavioral1
Sample
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
فہۧايہۧروسہ الہۧعہۧراق هناا
jaki3254.ddns.net:2001
85039fd7c6f37e1e0601b12298c6e30f
-
reg_key
85039fd7c6f37e1e0601b12298c6e30f
-
splitter
|'|'|
Targets
-
-
Target
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb
-
Size
204KB
-
MD5
1de82b571fa4d2e2eecd41a2c5b02346
-
SHA1
df1c5c4a6cd3d4f3baea43997852299030a9fe25
-
SHA256
9d857b13726bec6e5693daebb4526f2967a006ae01f3a9b7724d53ff84de36cb
-
SHA512
6b56ba4ed488197b727d76e36d8a9a7d5df96965d426dcf2bd6fee297001e83fbe016b833a1464c5b8901e747e1b69d2cb73cd817a22aa5abb0896f8fbe9c093
-
SSDEEP
3072:1weUySPS680++CZF8888yVQmqNWS/rkSWZPFE0QrQ3kce:1lUuZF8888yqhNZYSWZ9E0QrQB
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-