General
-
Target
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f
-
Size
863KB
-
Sample
221125-zqvnlahd4x
-
MD5
c83a8098ded06f15dc4bdbafc09f4ecf
-
SHA1
3c45d7d4a0be2be37e1624dbb2ffe371ce95d587
-
SHA256
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f
-
SHA512
522add6bdf1f113db3eebc8ff7410decda5d12bb3b3953e39e99fd4d887d1468a169ee90baec75de7a79ff9c5c028d60e0345124a78ce9403311aacdc5466df6
-
SSDEEP
24576:TRmJkcoQricOIQxiZY1iaEtmUJ9tiO3BXB:gJZoQrbTFZY1iayJ933lB
Static task
static1
Behavioral task
behavioral1
Sample
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
njrat
0.7d
Bot
drazmatik56.no-ip.org:1604
5364b242e8892a314b968229a5ceac99
-
reg_key
5364b242e8892a314b968229a5ceac99
-
splitter
|'|'|
Targets
-
-
Target
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f
-
Size
863KB
-
MD5
c83a8098ded06f15dc4bdbafc09f4ecf
-
SHA1
3c45d7d4a0be2be37e1624dbb2ffe371ce95d587
-
SHA256
6ee54eeaa01c5288ec49a952974cdcd2e00f54078c7a028b1e4f57a1c8ec398f
-
SHA512
522add6bdf1f113db3eebc8ff7410decda5d12bb3b3953e39e99fd4d887d1468a169ee90baec75de7a79ff9c5c028d60e0345124a78ce9403311aacdc5466df6
-
SSDEEP
24576:TRmJkcoQricOIQxiZY1iaEtmUJ9tiO3BXB:gJZoQrbTFZY1iayJ933lB
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-