General
-
Target
025bd33a6ced68b65c773adcb74e9b4a.exe
-
Size
104KB
-
Sample
230403-16splsac78
-
MD5
025bd33a6ced68b65c773adcb74e9b4a
-
SHA1
f7e25d55ea4a7bceb8959398dba176fdda7b5f94
-
SHA256
724ad06a9914ce390285c690973f4160db8438280e03e343918a3bc6dcaaa035
-
SHA512
46db0d404982d23a9c27cff77f0731ab1bfbaba68539988ad631ecf50b7133942a92e46265cc0a866ea8466a84de92183ab817ec6546e4a81a29c2634f254c9c
-
SSDEEP
1536:Ju9h8pR8yqX3amW2iwRCsfRneBaROZsvn/ga6BYLP1YTBeUIRc5IP1foubKb0i:Juj8fTM0kxeBCqYz1iBeUIm5I1fGh
Static task
static1
Behavioral task
behavioral1
Sample
025bd33a6ced68b65c773adcb74e9b4a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
025bd33a6ced68b65c773adcb74e9b4a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
im523
HacKed
45.141.26.54:1337
619caaa21abeda3dd8c1c8d9779b2992
-
reg_key
619caaa21abeda3dd8c1c8d9779b2992
-
splitter
|'|'|
Targets
-
-
Target
025bd33a6ced68b65c773adcb74e9b4a.exe
-
Size
104KB
-
MD5
025bd33a6ced68b65c773adcb74e9b4a
-
SHA1
f7e25d55ea4a7bceb8959398dba176fdda7b5f94
-
SHA256
724ad06a9914ce390285c690973f4160db8438280e03e343918a3bc6dcaaa035
-
SHA512
46db0d404982d23a9c27cff77f0731ab1bfbaba68539988ad631ecf50b7133942a92e46265cc0a866ea8466a84de92183ab817ec6546e4a81a29c2634f254c9c
-
SSDEEP
1536:Ju9h8pR8yqX3amW2iwRCsfRneBaROZsvn/ga6BYLP1YTBeUIRc5IP1foubKb0i:Juj8fTM0kxeBCqYz1iBeUIm5I1fGh
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-