General
-
Target
e4d4d3f3c152dfefe2891f0df04e2bed.bin
-
Size
754KB
-
Sample
230605-p5tdzahc4y
-
MD5
e4d4d3f3c152dfefe2891f0df04e2bed
-
SHA1
a3859162a3055e2aa6fdcc3295be2ef629e196d9
-
SHA256
08ecafbf85104c1a8930a8975a0757d542c8546897b04827077951b428f68b41
-
SHA512
2d1d98db1209b9ec33b7aabfa688d09337418524bcbc636b8d9acdf053bc802a2f96ce9242fbd0df0a646c2dac6f2238d4503ef08412ba62c6f168df18832ebe
-
SSDEEP
12288:yToPWBv/cpGrU3yiMx+XWDYd8lsOju0tzHCvg+nyRzST1opFK0tfmqWGK8F:yTbBv5rUexBDissOjuGHCBy45wFK0xmg
Static task
static1
Behavioral task
behavioral1
Sample
e4d4d3f3c152dfefe2891f0df04e2bed.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e4d4d3f3c152dfefe2891f0df04e2bed.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
im523
HacKed
browser-bangladesh.at.ply.gg:14018
675f4fe6228789d2c44bb51781f399e5
-
reg_key
675f4fe6228789d2c44bb51781f399e5
-
splitter
|'|'|
Targets
-
-
Target
e4d4d3f3c152dfefe2891f0df04e2bed.bin
-
Size
754KB
-
MD5
e4d4d3f3c152dfefe2891f0df04e2bed
-
SHA1
a3859162a3055e2aa6fdcc3295be2ef629e196d9
-
SHA256
08ecafbf85104c1a8930a8975a0757d542c8546897b04827077951b428f68b41
-
SHA512
2d1d98db1209b9ec33b7aabfa688d09337418524bcbc636b8d9acdf053bc802a2f96ce9242fbd0df0a646c2dac6f2238d4503ef08412ba62c6f168df18832ebe
-
SSDEEP
12288:yToPWBv/cpGrU3yiMx+XWDYd8lsOju0tzHCvg+nyRzST1opFK0tfmqWGK8F:yTbBv5rUexBDissOjuGHCBy45wFK0xmg
Score10/10-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-