General
-
Target
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734
-
Size
204KB
-
Sample
221125-jjhsfsbf26
-
MD5
fdc35f7a54217cf293dbe16ec3b215d5
-
SHA1
e8650ef7f694e4b94e72ec1f4241d9d700de044a
-
SHA256
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734
-
SHA512
411104975a15bd20f75affd39dc84cf56c40c4d26da51da73ff047322a140ac763b35ac6e31813415624977186e9eb3966a8a86e1a05a3f1ce32a405191bbf05
-
SSDEEP
3072:YS680+GweUySK99999999999999999999999999999999999P99999999999999x:0lUhDcAmkguxJC3Ol7
Behavioral task
behavioral1
Sample
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
فہۧايہۧروسہ الہۧعہۧراق هناا
jaki3254.ddns.net:2001
85039fd7c6f37e1e0601b12298c6e30f
-
reg_key
85039fd7c6f37e1e0601b12298c6e30f
-
splitter
|'|'|
Targets
-
-
Target
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734
-
Size
204KB
-
MD5
fdc35f7a54217cf293dbe16ec3b215d5
-
SHA1
e8650ef7f694e4b94e72ec1f4241d9d700de044a
-
SHA256
702a2d6873ddacfed8041d40ab25afc12c6d183ee2c14d80896ca87909e76734
-
SHA512
411104975a15bd20f75affd39dc84cf56c40c4d26da51da73ff047322a140ac763b35ac6e31813415624977186e9eb3966a8a86e1a05a3f1ce32a405191bbf05
-
SSDEEP
3072:YS680+GweUySK99999999999999999999999999999999999P99999999999999x:0lUhDcAmkguxJC3Ol7
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-