General
-
Target
ankieta.exe
-
Size
23KB
-
Sample
230526-mszdcafa86
-
MD5
55c94778b53f33c48439844afba5d462
-
SHA1
d63ba9eb29f3fed6cce5f640627fd8fb8a06d783
-
SHA256
4cf026eb53956b4017914b820c1918116cd88adb484339d698127f5257e2b8ed
-
SHA512
50981efb97a95834c9b9b92279ec760692fccab6209eed8eb6ee678249e0cf84c69919474326d506973be9e557442f7f017ff4fcb7cd1b0eb9ce55e5728914fb
-
SSDEEP
384:2Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmD:ZL2s+tRyRpcnur
Behavioral task
behavioral1
Sample
ankieta.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ankieta.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
njrat
0.7d
ankieta
194.62.1.7:5552
3b4dedf3f1158ff11bd86e73dce1ac44
-
reg_key
3b4dedf3f1158ff11bd86e73dce1ac44
-
splitter
|'|'|
Targets
-
-
Target
ankieta.exe
-
Size
23KB
-
MD5
55c94778b53f33c48439844afba5d462
-
SHA1
d63ba9eb29f3fed6cce5f640627fd8fb8a06d783
-
SHA256
4cf026eb53956b4017914b820c1918116cd88adb484339d698127f5257e2b8ed
-
SHA512
50981efb97a95834c9b9b92279ec760692fccab6209eed8eb6ee678249e0cf84c69919474326d506973be9e557442f7f017ff4fcb7cd1b0eb9ce55e5728914fb
-
SSDEEP
384:2Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmD:ZL2s+tRyRpcnur
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-