General
-
Target
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d
-
Size
392KB
-
Sample
221128-xx3xfaeb2v
-
MD5
27682f4b7802bda10128a93a490b92c7
-
SHA1
bc049a8ac719e8388cd8e64fdae77afc047686bb
-
SHA256
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d
-
SHA512
7ba9ceff372a61fbe603a7a894926fd7e6f2ec6f3cba3bbcae2c9693cd32875500446e8d73572e0c20f4b37c201495124a1544fe460708dfff9723aafd63bf95
-
SSDEEP
6144:3BL9TpbMr7uyrdwUEB1IaP/AYBiElzIlNUtg1Fo2s6ZaEfCtb/GVHY:3BLRcJHUIS/lBiElIlutgHo2pZs+H
Behavioral task
behavioral1
Sample
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
ahmedtiger1232.ddns.net:90
16ed6716f6ad090a92545fc485df99a1
-
reg_key
16ed6716f6ad090a92545fc485df99a1
-
splitter
|'|'|
Targets
-
-
Target
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d
-
Size
392KB
-
MD5
27682f4b7802bda10128a93a490b92c7
-
SHA1
bc049a8ac719e8388cd8e64fdae77afc047686bb
-
SHA256
d6259fb8a07f75e18f1d6e7da2f1f36e3b55d825888110348c9d0769fb89a31d
-
SHA512
7ba9ceff372a61fbe603a7a894926fd7e6f2ec6f3cba3bbcae2c9693cd32875500446e8d73572e0c20f4b37c201495124a1544fe460708dfff9723aafd63bf95
-
SSDEEP
6144:3BL9TpbMr7uyrdwUEB1IaP/AYBiElzIlNUtg1Fo2s6ZaEfCtb/GVHY:3BLRcJHUIS/lBiElIlutgHo2pZs+H
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-