General
-
Target
3D12A39E3A94131FC5CB7D5AD0A3AE94C94ED9F528A68.exe
-
Size
23KB
-
Sample
230331-rykjladb64
-
MD5
540c26994ac206f56ced1ab9097edd71
-
SHA1
ac5b7b5d505d5ec226ee2ecad0e0aa256c080a26
-
SHA256
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157
-
SHA512
8b0f653c5b547409f587b0440fd7d070f1b247be8562fdf9712479cf69c0d720cc19fc7a8850499de89c2588023e849c5647b4b27f54543c7d5e1c49388782cd
-
SSDEEP
384:6QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZkD:l5yBVd7Rpcnud
Behavioral task
behavioral1
Sample
3D12A39E3A94131FC5CB7D5AD0A3AE94C94ED9F528A68.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3D12A39E3A94131FC5CB7D5AD0A3AE94C94ED9F528A68.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
0.7d
HacKed
cisco5319.ddns.net:1177
22d454c9d4a86e192f7a5423970a5c83
-
reg_key
22d454c9d4a86e192f7a5423970a5c83
-
splitter
|'|'|
Targets
-
-
Target
3D12A39E3A94131FC5CB7D5AD0A3AE94C94ED9F528A68.exe
-
Size
23KB
-
MD5
540c26994ac206f56ced1ab9097edd71
-
SHA1
ac5b7b5d505d5ec226ee2ecad0e0aa256c080a26
-
SHA256
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157
-
SHA512
8b0f653c5b547409f587b0440fd7d070f1b247be8562fdf9712479cf69c0d720cc19fc7a8850499de89c2588023e849c5647b4b27f54543c7d5e1c49388782cd
-
SSDEEP
384:6QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZkD:l5yBVd7Rpcnud
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-