General
-
Target
tmp
-
Size
23KB
-
Sample
231125-pwtclsbb5y
-
MD5
a92ef911215a303fc49de97c4c6d837f
-
SHA1
cfbb4b778d946dde68746cc8160f75f02f975d1a
-
SHA256
cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4
-
SHA512
7ebce5b426033cdf54bb006f2c8ceb3a47cb49b4cf7207c65425df535e707b27a2b4a901dd297ba14955a4ad873bfe76ca2442a18ad73db51f9b957c9645a615
-
SSDEEP
384:yY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmM:lL2s+tRyRpcnus
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
njrat
0.7d
HacKed
needforrat.hopto.org:7772
47b887645f4457386c0b55e0a170685a
-
reg_key
47b887645f4457386c0b55e0a170685a
-
splitter
|'|'|
Targets
-
-
Target
tmp
-
Size
23KB
-
MD5
a92ef911215a303fc49de97c4c6d837f
-
SHA1
cfbb4b778d946dde68746cc8160f75f02f975d1a
-
SHA256
cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4
-
SHA512
7ebce5b426033cdf54bb006f2c8ceb3a47cb49b4cf7207c65425df535e707b27a2b4a901dd297ba14955a4ad873bfe76ca2442a18ad73db51f9b957c9645a615
-
SSDEEP
384:yY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmM:lL2s+tRyRpcnus
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1