General
-
Target
4a9efd5ecea388e5ce1d20b75060874b.exe
-
Size
2.0MB
-
Sample
230605-vp9nxaad4z
-
MD5
4a9efd5ecea388e5ce1d20b75060874b
-
SHA1
5cd3796b22f4c126df395f4fbb4285a3997ec345
-
SHA256
a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
-
SHA512
08186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
SSDEEP
3072:OgdUd3vlTmL/A5nzbYHnzVO9qtD2jW+/5LUa:adfiAxbYHnz5ay+/5L
Static task
static1
Behavioral task
behavioral1
Sample
4a9efd5ecea388e5ce1d20b75060874b.exe
Resource
win7-20230220-en
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
juancaf4000.duckdns.org:5050
2925ee0393c24d569
-
reg_key
2925ee0393c24d569
-
splitter
@!#&^%$
Targets
-
-
Target
4a9efd5ecea388e5ce1d20b75060874b.exe
-
Size
2.0MB
-
MD5
4a9efd5ecea388e5ce1d20b75060874b
-
SHA1
5cd3796b22f4c126df395f4fbb4285a3997ec345
-
SHA256
a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
-
SHA512
08186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
SSDEEP
3072:OgdUd3vlTmL/A5nzbYHnzVO9qtD2jW+/5LUa:adfiAxbYHnz5ay+/5L
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-