General
-
Target
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8
-
Size
23KB
-
Sample
221125-lnl2sage69
-
MD5
ba92dad10756935c6ba911220142f649
-
SHA1
52179e698584dc1eac64a0932db3df602a75b22e
-
SHA256
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8
-
SHA512
9323e99c80a76cd209d987bcbe25750e9ded79a657701802713fd70101550d9e84886afb329e62f5499870dfd2cb158b9cd3111e8e59cf8685eb22c26bb399c3
-
SSDEEP
384:d53gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZX2:dVIAKG91DP1hPRpcnu9
Behavioral task
behavioral1
Sample
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
BDOCERT
oqbpregoqbpreg.ddns.net:5552
60bab2eed75ad3333f713f5b24bffad6
-
reg_key
60bab2eed75ad3333f713f5b24bffad6
-
splitter
|'|'|
Targets
-
-
Target
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8
-
Size
23KB
-
MD5
ba92dad10756935c6ba911220142f649
-
SHA1
52179e698584dc1eac64a0932db3df602a75b22e
-
SHA256
3019ff465d9d7c657aa4e111da5212ffefa360d50a4586274bd38e067c7211f8
-
SHA512
9323e99c80a76cd209d987bcbe25750e9ded79a657701802713fd70101550d9e84886afb329e62f5499870dfd2cb158b9cd3111e8e59cf8685eb22c26bb399c3
-
SSDEEP
384:d53gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZX2:dVIAKG91DP1hPRpcnu9
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-