General
-
Target
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436
-
Size
264KB
-
Sample
230217-rjygxafc6y
-
MD5
695c5d19dc3c3c5cc39182e09d9274e6
-
SHA1
bc0aa3fce44b7d252919d820860709a0052cb76c
-
SHA256
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436
-
SHA512
a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b
-
SSDEEP
6144:D590Fz8uK5f2zeua122r32rSOrfpMvglH1wOQjlRRxlJ8QG:lgA12z0lrmrZrxYgp1ojlrh0
Static task
static1
Behavioral task
behavioral1
Sample
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
njrat
0.7d
zalupa180417
808080.ddns.net:5555
4cb72bb7475074f5af41f3e5e189ee3f
-
reg_key
4cb72bb7475074f5af41f3e5e189ee3f
-
splitter
|'|'|
Targets
-
-
Target
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436
-
Size
264KB
-
MD5
695c5d19dc3c3c5cc39182e09d9274e6
-
SHA1
bc0aa3fce44b7d252919d820860709a0052cb76c
-
SHA256
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436
-
SHA512
a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b
-
SSDEEP
6144:D590Fz8uK5f2zeua122r32rSOrfpMvglH1wOQjlRRxlJ8QG:lgA12z0lrmrZrxYgp1ojlrh0
Score10/10-
Modifies Windows Firewall
-
Drops startup file
-
Suspicious use of SetThreadContext
-