General
-
Target
11374849012dfeed18493578007f0c53.exe
-
Size
93KB
-
Sample
231201-jhq3faga7w
-
MD5
11374849012dfeed18493578007f0c53
-
SHA1
367d9ee8bbd2c911c8d9b51fa6f1b664e90036c2
-
SHA256
16607e62e5e61fd70634ebde62a145329a23d3d31867c2e86554b5f9ad313063
-
SHA512
46c9a2d2cef8771be3d6b22c88834a3e53de5c7b7751dff39e01566c01621a36225629dfba3fcdc5e1157fa49ee181ff05cd796b1825706e8a7a00a229721d6c
-
SSDEEP
768:oY37yTnkpjTMpALPGMtsas88EtNXhU9f1mxCXxrjEtCdnl2pi1Rz4Rk3vsGdp0gM:Ly7kVbPGHz88EbE1pjEwzGi1dDbD0gS
Behavioral task
behavioral1
Sample
11374849012dfeed18493578007f0c53.exe
Resource
win7-20231023-en
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
5.tcp.eu.ngrok.io:13940
d31f5482257e7847270785c2b6a88c7b
-
reg_key
d31f5482257e7847270785c2b6a88c7b
-
splitter
|'|'|
Targets
-
-
Target
11374849012dfeed18493578007f0c53.exe
-
Size
93KB
-
MD5
11374849012dfeed18493578007f0c53
-
SHA1
367d9ee8bbd2c911c8d9b51fa6f1b664e90036c2
-
SHA256
16607e62e5e61fd70634ebde62a145329a23d3d31867c2e86554b5f9ad313063
-
SHA512
46c9a2d2cef8771be3d6b22c88834a3e53de5c7b7751dff39e01566c01621a36225629dfba3fcdc5e1157fa49ee181ff05cd796b1825706e8a7a00a229721d6c
-
SSDEEP
768:oY37yTnkpjTMpALPGMtsas88EtNXhU9f1mxCXxrjEtCdnl2pi1Rz4Rk3vsGdp0gM:Ly7kVbPGHz88EbE1pjEwzGi1dDbD0gS
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-