General
-
Target
70D8A4CFE8F75BEF1D5CEA3BA0CCA2D0.exe
-
Size
31KB
-
Sample
231017-1j6myshd6t
-
MD5
70d8a4cfe8f75bef1d5cea3ba0cca2d0
-
SHA1
636d0bb422ed168d310a31160d69aef1aec90d68
-
SHA256
6a949940330b0828af63f56d10981f8596ef1c24952b058e40af09ce6e947100
-
SHA512
31ae3fc6ff416925040d4a7aa40d46b411786c1269c6fbdb0386a05cd5211774c2c0cd13dddecbcec2e3919278cd2c659549a7d7f74355bda3f81e8b196cc561
-
SSDEEP
768:ZRZghV5VXPKzxF+dt+XKvJ+rvaPQmIDUu0tipcj:mfqciMQVkzj
Behavioral task
behavioral1
Sample
70D8A4CFE8F75BEF1D5CEA3BA0CCA2D0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
70D8A4CFE8F75BEF1D5CEA3BA0CCA2D0.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
njrat
0.7d
MyBot
myvnc.myftp.biz:5552
4d303b772c7c7805c5e01990e7310d1a
-
reg_key
4d303b772c7c7805c5e01990e7310d1a
-
splitter
Y262SUCZ4UJJ
Targets
-
-
Target
70D8A4CFE8F75BEF1D5CEA3BA0CCA2D0.exe
-
Size
31KB
-
MD5
70d8a4cfe8f75bef1d5cea3ba0cca2d0
-
SHA1
636d0bb422ed168d310a31160d69aef1aec90d68
-
SHA256
6a949940330b0828af63f56d10981f8596ef1c24952b058e40af09ce6e947100
-
SHA512
31ae3fc6ff416925040d4a7aa40d46b411786c1269c6fbdb0386a05cd5211774c2c0cd13dddecbcec2e3919278cd2c659549a7d7f74355bda3f81e8b196cc561
-
SSDEEP
768:ZRZghV5VXPKzxF+dt+XKvJ+rvaPQmIDUu0tipcj:mfqciMQVkzj
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1