General
-
Target
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441
-
Size
1.2MB
-
Sample
221125-hnvgdacg7s
-
MD5
6ed29f629da1a85b7b854aafda1e369a
-
SHA1
25cdd05e00d1900aabca3e8a7d11f1a9e4547e3a
-
SHA256
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441
-
SHA512
75833a06204dc1d763105ccd427d667cfab5f060e310ab329d243e71f00ae0aa65ecc322ff35291a6ddfcea912a84506d6a99c62d4c38dc4a1958d0b31bd176b
-
SSDEEP
24576:0tb20pkaCqT5TBWgNQ7ar3YKEBCd1s31LgABGkoyXtkcnO16A:dVg5tQ7ar3GB+1eLFtvnG5
Static task
static1
Behavioral task
behavioral1
Sample
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
njrat
0.7d
A0AYFJ0PJtXGl9PaJat
193.0.200.131:35689
0dcfc9e55379c2e16a422bb33c97d277
-
reg_key
0dcfc9e55379c2e16a422bb33c97d277
-
splitter
|'|'|
Targets
-
-
Target
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441
-
Size
1.2MB
-
MD5
6ed29f629da1a85b7b854aafda1e369a
-
SHA1
25cdd05e00d1900aabca3e8a7d11f1a9e4547e3a
-
SHA256
e606ebb8d01184c9bb6f684b03acae1f54b8f4faafcbf6c8f0be404b32a61441
-
SHA512
75833a06204dc1d763105ccd427d667cfab5f060e310ab329d243e71f00ae0aa65ecc322ff35291a6ddfcea912a84506d6a99c62d4c38dc4a1958d0b31bd176b
-
SSDEEP
24576:0tb20pkaCqT5TBWgNQ7ar3YKEBCd1s31LgABGkoyXtkcnO16A:dVg5tQ7ar3GB+1eLFtvnG5
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-