General
-
Target
017fa7a20c92152e2a5533f75f090469_JC.bin
-
Size
34KB
-
Sample
230901-w7msjagf3x
-
MD5
1ad3e78de9a9dc546a6da32522b80344
-
SHA1
b4bfeead9ab32d476ba3b3c3843eae54db1c9202
-
SHA256
eb8340a8de898bb8e193469e8abb1781ce0d2d55b8970b6d6521af692dd590de
-
SHA512
71c5e4174ca4d294ac3f2fb4c54621ac9b1f2b1019515f28099626b0ebb2ef0abf40a2d72aefd579f56a24664528441fa911e666ac54d44e007519b24905f4a4
-
SSDEEP
768:xJgBrFpVjwHttnY68VzC93p+ASbCQMHVkahYmkU3ywuJUwkj:xJWpVjwznY3k4ASbCHk3mkS
Behavioral task
behavioral1
Sample
bc9c846acf87982d46c27024cd876656135ecffa39bd5406beb77af3df215e94.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bc9c846acf87982d46c27024cd876656135ecffa39bd5406beb77af3df215e94.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
njrat
0.7d
Лошок
hakim32.ddns.net:2000
0.tcp.eu.ngrok.io:19067
03c49c7f7bdfd684069ba84c510171c9
-
reg_key
03c49c7f7bdfd684069ba84c510171c9
-
splitter
|'|'|
Targets
-
-
Target
bc9c846acf87982d46c27024cd876656135ecffa39bd5406beb77af3df215e94.exe
-
Size
93KB
-
MD5
017fa7a20c92152e2a5533f75f090469
-
SHA1
7ea751d6b4f9f03e4f23603103edc4ccfdebbfdc
-
SHA256
bc9c846acf87982d46c27024cd876656135ecffa39bd5406beb77af3df215e94
-
SHA512
6d330633b96af51187c362c280e00d3a0a199bf4ff5f21dfddd591dbffafd18b9e0fb5154dffbae0c94790addc62763c872ce10c7ae93a4cdf73e1b26d303ba5
-
SSDEEP
1536:TewOQIBlfGQFk2ZonmzaMxjEwzGi1dDsD1gS:TewMtFk2ZonmuMOi1dSC
Score8/10-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Drops startup file
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-