General
-
Target
Payloa2d.bin.zip
-
Size
23KB
-
Sample
230605-qcrv4sgg52
-
MD5
5a6efcccd6c6f67423258c6e187ffd34
-
SHA1
183f284c2de49c7fcb0e428d97a859395e8805f6
-
SHA256
0c8f6cc975543e70301e19e3c74a291daf2368ef68ec3a22065f1183512be5a7
-
SHA512
f32b26486bf3a677000e4b3e7551510f545c5c8b914df8eb7e7e7ae1956d47af15471faaefc7c5491ce152354d8c1a7eed492ab28568b4abb36aeb4da2c157dc
-
SSDEEP
384:CHoXIuYLWkibg52mdiRTxyOgg/MRvoARDAwAp+YWS0EYV3rHTEQvTCHstJn0imLC:CLuYLWkv2CiRTx/ggkNvD6WSPYVbHQUx
Behavioral task
behavioral1
Sample
Payloa2d.bin.zip
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Pfas
46.147.175.250:777
912a1f951d033ffc677042d1ef13224f
-
reg_key
912a1f951d033ffc677042d1ef13224f
-
splitter
Y262SUCZ4UJJ
Targets
-
-
Target
Payloa2d.bin.zip
-
Size
23KB
-
MD5
5a6efcccd6c6f67423258c6e187ffd34
-
SHA1
183f284c2de49c7fcb0e428d97a859395e8805f6
-
SHA256
0c8f6cc975543e70301e19e3c74a291daf2368ef68ec3a22065f1183512be5a7
-
SHA512
f32b26486bf3a677000e4b3e7551510f545c5c8b914df8eb7e7e7ae1956d47af15471faaefc7c5491ce152354d8c1a7eed492ab28568b4abb36aeb4da2c157dc
-
SSDEEP
384:CHoXIuYLWkibg52mdiRTxyOgg/MRvoARDAwAp+YWS0EYV3rHTEQvTCHstJn0imLC:CLuYLWkv2CiRTx/ggkNvD6WSPYVbHQUx
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-