Overview
overview
10Static
static
10Plugin/cam.dll
windows7-x64
1Plugin/cam.dll
windows10-2004-x64
1Plugin/ch.dll
windows7-x64
1Plugin/ch.dll
windows10-2004-x64
1Plugin/mic.dll
windows7-x64
1Plugin/mic.dll
windows10-2004-x64
1Plugin/plg.dll
windows7-x64
1Plugin/plg.dll
windows10-2004-x64
1Plugin/pw.dll
windows7-x64
1Plugin/pw.dll
windows10-2004-x64
1Plugin/sc2.dll
windows7-x64
1Plugin/sc2.dll
windows10-2004-x64
1Stub.xml
windows7-x64
1Stub.xml
windows10-2004-x64
1WinMM.Net.dll
windows7-x64
1WinMM.Net.dll
windows10-2004-x64
1njRAT v0.7d.exe
windows7-x64
10njRAT v0.7d.exe
windows10-2004-x64
10stub.ps1
windows7-x64
1stub.ps1
windows10-2004-x64
1General
-
Target
ff974eed3a39673cfe330cf7ed87521887301ab58b71d7dd2d6d15fc197313b5
-
Size
781KB
-
Sample
221126-r54k2sef7s
-
MD5
3bdd5d58ae0a3dfa5d317a7c6089f0d3
-
SHA1
6d4657859442c62f205658104c03bf99a716a08b
-
SHA256
ff974eed3a39673cfe330cf7ed87521887301ab58b71d7dd2d6d15fc197313b5
-
SHA512
feefb336c05d4a1669015f649e56b6fc837f4a1e4def75f40e3945ebed23eafb6416b6057dafa97211881877043b932d2803c4c54dc08a7445712413f24a4d9b
-
SSDEEP
12288:76efNNVqR/SjOV12bv3wamzM2wKrKuHKm+6JDSsc5cu3HuhnTw6yP4P2Axbo8:t1uSj5v3wLzpdHF7c7HWjj2A08
Behavioral task
behavioral1
Sample
Plugin/cam.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Plugin/cam.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Plugin/ch.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Plugin/ch.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Plugin/mic.dll
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
Plugin/mic.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Plugin/plg.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Plugin/plg.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Plugin/pw.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Plugin/pw.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Plugin/sc2.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Plugin/sc2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Stub.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Stub.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
WinMM.Net.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
WinMM.Net.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
njRAT v0.7d.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
njRAT v0.7d.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
stub.ps1
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
stub.ps1
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
Plugin/cam.dll
-
Size
63KB
-
MD5
a73edb60b80a2dfa86735d821bea7b19
-
SHA1
f39a54d7bc25425578a2b800033e4508714a73ed
-
SHA256
7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
-
SHA512
283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
-
SSDEEP
1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
Score1/10 -
-
-
Target
Plugin/ch.dll
-
Size
12KB
-
MD5
e747fa3339c1f138b6bfce707b541d03
-
SHA1
b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
-
SHA256
6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
-
SHA512
b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
-
SSDEEP
192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
Score1/10 -
-
-
Target
Plugin/mic.dll
-
Size
50KB
-
MD5
d4c5ddc00f27162fc0947830e0e762b7
-
SHA1
7769be616d752e95d80e167f2ef4cc6b8c3c21fe
-
SHA256
b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
-
SHA512
9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
-
SSDEEP
1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
Score1/10 -
-
-
Target
Plugin/plg.dll
-
Size
28KB
-
MD5
0cbc2d9703feead9783439e551c2b673
-
SHA1
4f8f4addd6f9e60598a7f4a191a89a52201394a8
-
SHA256
ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
-
SHA512
06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
-
SSDEEP
384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
Score1/10 -
-
-
Target
Plugin/pw.dll
-
Size
39KB
-
MD5
db87daf76c15f3808cec149f639aa64f
-
SHA1
d67f84a44ddc25432ce179aeba9cff778af746ee
-
SHA256
a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
-
SHA512
ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
-
SSDEEP
768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
Score1/10 -
-
-
Target
Plugin/sc2.dll
-
Size
12KB
-
MD5
19967e886edcd2f22f8d4a58c8ea3773
-
SHA1
bf6e0e908eaad659fdd32572e9d73c5476ca26ec
-
SHA256
3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
-
SHA512
d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
-
SSDEEP
192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
Score1/10 -
-
-
Target
Stub.manifest
-
Size
487B
-
MD5
4d18ac38a92d15a64e2b80447b025b7e
-
SHA1
5c34374c2dd5afa92e0489f1d6f86dde616aca6c
-
SHA256
835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
-
SHA512
72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
Score1/10 -
-
-
Target
WinMM.Net.dll
-
Size
43KB
-
MD5
d4b80052c7b4093e10ce1f40ce74f707
-
SHA1
2494a38f1c0d3a0aa9b31cf0650337cacc655697
-
SHA256
59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
-
SHA512
3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
-
SSDEEP
768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
Score1/10 -
-
-
Target
njRAT v0.7d.exe
-
Size
55KB
-
MD5
cac62bc1ad7ba8129d87f1bc1178c814
-
SHA1
55f02c854540df27c4d57ace83c5c91c37cf36e9
-
SHA256
4bc7b459b9842ad4dfaadbb8c280119945050d4cc46780f3fdd3bc3a9c44d027
-
SHA512
972f793b8396d9064d52407701b5b731b21f7a4604bae1b37cbff1aa3fcd72064a71e20838b3f7bfaf35d6703de9ea69f909271be0ca5b0055f1ad89af8dade7
-
SSDEEP
768:sI3KDIyPKpLwby2f+ucnE4D/JJmjbaccM4lKSO9IQ:srDwfD/JJmvRUKSO9R
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
-
-
Target
stub.il
-
Size
228KB
-
MD5
2041e64bffccfbc9379235fdf294f188
-
SHA1
19c1fd78e8f36493e2a9b1c0e437afc2416586f8
-
SHA256
daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
-
SHA512
c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
-
SSDEEP
6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
Score1/10 -