General
-
Target
unins000.exe
-
Size
120KB
-
Sample
230627-rk2wqaed83
-
MD5
fedc44d49ac077434621ed7b00e9233f
-
SHA1
6ce87223da9aa55e9695be288712b04612c8a981
-
SHA256
9f60fbfc28e3875762e45a63f9e3ce5dc6b993fe930b2b2f26ba999bd334668e
-
SHA512
79622da4e20d655d36bbaa5936cde110300edccd876decf20c679b567542330541eedf330e6f1ffab4d824d3f9cf073f6e02f3cc75e62c29c0b1893a902e0bb0
-
SSDEEP
3072:t+IH9U8Hp2k9VNq7OA23/RcY1CYS9B3pr8L4dOE:5imdNq7Oj3/K+S93O4
Static task
static1
Behavioral task
behavioral1
Sample
unins000.exe
Resource
win7-20230621-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
BackUp
style-camps.craft.ply.gg:37572
Text attrib corrector
-
reg_key
Text attrib corrector
-
splitter
|Hassan|
Targets
-
-
Target
unins000.exe
-
Size
120KB
-
MD5
fedc44d49ac077434621ed7b00e9233f
-
SHA1
6ce87223da9aa55e9695be288712b04612c8a981
-
SHA256
9f60fbfc28e3875762e45a63f9e3ce5dc6b993fe930b2b2f26ba999bd334668e
-
SHA512
79622da4e20d655d36bbaa5936cde110300edccd876decf20c679b567542330541eedf330e6f1ffab4d824d3f9cf073f6e02f3cc75e62c29c0b1893a902e0bb0
-
SSDEEP
3072:t+IH9U8Hp2k9VNq7OA23/RcY1CYS9B3pr8L4dOE:5imdNq7Oj3/K+S93O4
Score10/10-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-