General
-
Target
6c16c29393e52ccda35c043aea1b1940.exe
-
Size
37KB
-
Sample
230320-l7xydsch49
-
MD5
6c16c29393e52ccda35c043aea1b1940
-
SHA1
f440a53a8e1949aa361a311721b88efb7122e56a
-
SHA256
4445051491aed9c868c6641f7b2ff844047b5e61414bbc6e440ef2d7202348a5
-
SHA512
90d54c328c8443dcbba6be755578bd8c62fbb633000aafdba9d305e1b42a0e7b7bea8dfff978044c8712855ed72d71325f105ec1999c7a622e8d3bf6f7532f44
-
SSDEEP
384:1SSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXO:sS7TZ38fvCv3E1c1rM+rMRa8Nuvct
Behavioral task
behavioral1
Sample
6c16c29393e52ccda35c043aea1b1940.exe
Resource
win7-20230220-en
Malware Config
Extracted
njrat
im523
HacKed
0.tcp.sa.ngrok.io:19784
d129900b08bb5de7ee3568103142da72
-
reg_key
d129900b08bb5de7ee3568103142da72
-
splitter
|'|'|
Targets
-
-
Target
6c16c29393e52ccda35c043aea1b1940.exe
-
Size
37KB
-
MD5
6c16c29393e52ccda35c043aea1b1940
-
SHA1
f440a53a8e1949aa361a311721b88efb7122e56a
-
SHA256
4445051491aed9c868c6641f7b2ff844047b5e61414bbc6e440ef2d7202348a5
-
SHA512
90d54c328c8443dcbba6be755578bd8c62fbb633000aafdba9d305e1b42a0e7b7bea8dfff978044c8712855ed72d71325f105ec1999c7a622e8d3bf6f7532f44
-
SSDEEP
384:1SSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXO:sS7TZ38fvCv3E1c1rM+rMRa8Nuvct
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-