General
-
Target
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
-
Size
29KB
-
Sample
221126-klpjfsab2z
-
MD5
07ae3808ff61ee050d7f46ebc7ae8553
-
SHA1
fcde926f75efadf892e00374f42bace1328a83ad
-
SHA256
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
-
SHA512
3f688d38dfaec6344475c2f14afc3d91edc69fe29d02f5b0404951c0abde03d7e32b629e48eee4a266209602eead12b0e8b34e264aa3ff710de08502b0d390fe
-
SSDEEP
384:8hQXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzIH:8E7Js8oDSJz4wqZXenBKh0p29SgRQl5
Behavioral task
behavioral1
Sample
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.6.4
HacKed
heroznt1.no-ip.biz:5552
043268c986c44a75878ff249a24b122e
-
reg_key
043268c986c44a75878ff249a24b122e
-
splitter
|'|'|
Targets
-
-
Target
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
-
Size
29KB
-
MD5
07ae3808ff61ee050d7f46ebc7ae8553
-
SHA1
fcde926f75efadf892e00374f42bace1328a83ad
-
SHA256
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
-
SHA512
3f688d38dfaec6344475c2f14afc3d91edc69fe29d02f5b0404951c0abde03d7e32b629e48eee4a266209602eead12b0e8b34e264aa3ff710de08502b0d390fe
-
SSDEEP
384:8hQXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzIH:8E7Js8oDSJz4wqZXenBKh0p29SgRQl5
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-