General
-
Target
CheatV10.exe
-
Size
37KB
-
Sample
230416-t835sscd2w
-
MD5
c4b11e9b3b4d06b6a09e8f7090c64a8f
-
SHA1
658da340df61a09845c44ffffbec36bc0fd1c558
-
SHA256
36c0c6a9188729df349a356a7b657ee52978d51807d4bd77e4cb496e266a5731
-
SHA512
c4e27ee46698e7e17e0f1ecee638ca29007b5eddb1160d68cd0dbaaf7fbef955294b0f3e8fb2f6ca3ed3a8ec1b378ca2c53bc029d0c3adf5f99375844f71deda
-
SSDEEP
384:2Hm1/CiMr3jBVbJsy8PNobAoZ/7vTQiQZgZrAF+rMRTyN/0L+EcoinblneHQM3eD:eJbJP8PNEAqPFQkrM+rMRa8NuD9t
Behavioral task
behavioral1
Sample
CheatV10.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CheatV10.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
njrat
im523
HacKed
academic-furnishings.at.ply.gg:55855
578db8a9fb03841e750a46ff4852e1f0
-
reg_key
578db8a9fb03841e750a46ff4852e1f0
-
splitter
|'|'|
Targets
-
-
Target
CheatV10.exe
-
Size
37KB
-
MD5
c4b11e9b3b4d06b6a09e8f7090c64a8f
-
SHA1
658da340df61a09845c44ffffbec36bc0fd1c558
-
SHA256
36c0c6a9188729df349a356a7b657ee52978d51807d4bd77e4cb496e266a5731
-
SHA512
c4e27ee46698e7e17e0f1ecee638ca29007b5eddb1160d68cd0dbaaf7fbef955294b0f3e8fb2f6ca3ed3a8ec1b378ca2c53bc029d0c3adf5f99375844f71deda
-
SSDEEP
384:2Hm1/CiMr3jBVbJsy8PNobAoZ/7vTQiQZgZrAF+rMRTyN/0L+EcoinblneHQM3eD:eJbJP8PNEAqPFQkrM+rMRa8NuD9t
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-