General
-
Target
540c26994ac206f56ced1ab9097edd71.bin
-
Size
11KB
-
Sample
230402-bzjqpafc6s
-
MD5
dace19981162d1bb51679f45c2e3bae9
-
SHA1
ff4efcc5b150ed4ea60ada4eeda2513cc00ea70f
-
SHA256
5da576eef71856a926caecf0091f4468e60509d03eb162b8a96e9550f55a597c
-
SHA512
1a10544fd681ceff666f5958bb088742ae450bf72632ffcbc5374a70ad377d954c3b21c787337506efa741e12559de10a7def54c49e1e5d9be784a9ba90e1790
-
SSDEEP
192:XChBqn41G7SK+t7mSaxgCfsb1ZsRgknPcJq8fpn6tkoBAGWC78N3zCqMNAR5Xk8R:yTF1kSKc745yjs6+koS7ZBoG
Behavioral task
behavioral1
Sample
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
0.7d
HacKed
cisco5319.ddns.net:1177
22d454c9d4a86e192f7a5423970a5c83
-
reg_key
22d454c9d4a86e192f7a5423970a5c83
-
splitter
|'|'|
Targets
-
-
Target
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe
-
Size
23KB
-
MD5
540c26994ac206f56ced1ab9097edd71
-
SHA1
ac5b7b5d505d5ec226ee2ecad0e0aa256c080a26
-
SHA256
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157
-
SHA512
8b0f653c5b547409f587b0440fd7d070f1b247be8562fdf9712479cf69c0d720cc19fc7a8850499de89c2588023e849c5647b4b27f54543c7d5e1c49388782cd
-
SSDEEP
384:6QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZkD:l5yBVd7Rpcnud
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-