General
-
Target
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp
-
Size
72KB
-
Sample
230206-3pcyyagd72
-
MD5
d7c9553b35cd383d91b65291e228d75e
-
SHA1
bcb9606e2c4ba2ee2065ace2c9be99e162e3f17b
-
SHA256
aea8fca4704a2acab5b815530a77795c874c85bcf5562d07b649d0c99e8f8424
-
SHA512
a8a0fe5c85e5b75b709d98fb9499d9279f346a6f338ea81bdf53d3d7fc2641b4e0508332151ebceebf401f33da8a9ef0e19397142e943e18d2adb30c372fee33
-
SSDEEP
384:fZyoIYz/wpa9GP4Uy2vXy2m2EUSlhqzIIij+ZsNO3PlpJKkkjh/TzF7pWnb/greL:hnIKR4gh2vyV2SwuXQ/oCX+L
Behavioral task
behavioral1
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
4.tcp.eu.ngrok.io:12433
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp
-
Size
72KB
-
MD5
d7c9553b35cd383d91b65291e228d75e
-
SHA1
bcb9606e2c4ba2ee2065ace2c9be99e162e3f17b
-
SHA256
aea8fca4704a2acab5b815530a77795c874c85bcf5562d07b649d0c99e8f8424
-
SHA512
a8a0fe5c85e5b75b709d98fb9499d9279f346a6f338ea81bdf53d3d7fc2641b4e0508332151ebceebf401f33da8a9ef0e19397142e943e18d2adb30c372fee33
-
SSDEEP
384:fZyoIYz/wpa9GP4Uy2vXy2m2EUSlhqzIIij+ZsNO3PlpJKkkjh/TzF7pWnb/greL:hnIKR4gh2vyV2SwuXQ/oCX+L
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-