General
-
Target
39678e8a69e720df9139d2474d78add7f464610ceabfd17b49518427107ab8ec
-
Size
29KB
-
Sample
221126-klwmrsab3x
-
MD5
21dfeafc97d010ac6621bce05fec35a2
-
SHA1
153628124344521d76a63464ae00165e7749007a
-
SHA256
39678e8a69e720df9139d2474d78add7f464610ceabfd17b49518427107ab8ec
-
SHA512
099ce2105c184faef54b4d6860c394b00eff8cbb4453d41ac8d96fa38157da4c97d9eb5597529d3548c5d257efac69a5fd6671f386dc27d22417b011a8d1fc0e
-
SSDEEP
768:vQv/27NYsDkfZPoIqlHepBKh0p29SgRF2:4m7N143wEKhG29jF2
Behavioral task
behavioral1
Sample
39678e8a69e720df9139d2474d78add7f464610ceabfd17b49518427107ab8ec.exe
Resource
win7-20220812-en
Malware Config
Extracted
njrat
0.6.4
shemo
shemo.no-ip.org:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
39678e8a69e720df9139d2474d78add7f464610ceabfd17b49518427107ab8ec
-
Size
29KB
-
MD5
21dfeafc97d010ac6621bce05fec35a2
-
SHA1
153628124344521d76a63464ae00165e7749007a
-
SHA256
39678e8a69e720df9139d2474d78add7f464610ceabfd17b49518427107ab8ec
-
SHA512
099ce2105c184faef54b4d6860c394b00eff8cbb4453d41ac8d96fa38157da4c97d9eb5597529d3548c5d257efac69a5fd6671f386dc27d22417b011a8d1fc0e
-
SSDEEP
768:vQv/27NYsDkfZPoIqlHepBKh0p29SgRF2:4m7N143wEKhG29jF2
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-