General
-
Target
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74
-
Size
204KB
-
Sample
221125-hrw5dada7z
-
MD5
7bcdf5ffd98d96d425430e50197f58a0
-
SHA1
a0956ae19d7bbe29040c78b3c2d233711b037586
-
SHA256
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74
-
SHA512
5570cb5dab7736a770b85f3956dba27574528ff07c74a50e1bb0cfbd460fc22e4dfd332f3d57be7309600bc28852a23b26f24dcc12e66e59980a29f3b773b7d4
-
SSDEEP
3072:+weUySPS680+ZZRLw4O97gCSpnRFe9cSjVetIV9zYzU38gMfIXqcv:+lU4W9RSRRFceo7/MwZ
Behavioral task
behavioral1
Sample
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
njrat
0.7d
فہۧايہۧروسہ الہۧعہۧراق هناا
jaki3254.ddns.net:2001
85039fd7c6f37e1e0601b12298c6e30f
-
reg_key
85039fd7c6f37e1e0601b12298c6e30f
-
splitter
|'|'|
Targets
-
-
Target
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74
-
Size
204KB
-
MD5
7bcdf5ffd98d96d425430e50197f58a0
-
SHA1
a0956ae19d7bbe29040c78b3c2d233711b037586
-
SHA256
d8ab54cd9574b59d10431f522cfd382104e1aa3497659c3b2b9d67bf1215bd74
-
SHA512
5570cb5dab7736a770b85f3956dba27574528ff07c74a50e1bb0cfbd460fc22e4dfd332f3d57be7309600bc28852a23b26f24dcc12e66e59980a29f3b773b7d4
-
SSDEEP
3072:+weUySPS680+ZZRLw4O97gCSpnRFe9cSjVetIV9zYzU38gMfIXqcv:+lU4W9RSRRFceo7/MwZ
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-