General
-
Target
3e11cb3c0f8a62aae331760a08a52482
-
Size
448KB
-
Sample
231222-ba8nhscaa2
-
MD5
3e11cb3c0f8a62aae331760a08a52482
-
SHA1
1b51873e437c3bd1a60347433f85af3355a5c7ca
-
SHA256
6200c47886500281876a02904d64d2edd143cc58d8042b2cca615a326cd9aa5d
-
SHA512
4bc555458b0641f4fabed65e2e24d47704083432dfdebb647aeb4b026bb86daaa8768b4e022662c658662c398409b17eb03c678ef94297766729989590da2f92
-
SSDEEP
3072:a5rSi9mLPT63Q77NhQGMHphGw+EIsxw8baRYX2NCancRu7AlSfZEPCNHLI0p79LX:GrSi9cPCQ7JTMJvjO9LN5odGw0kaV
Static task
static1
Behavioral task
behavioral1
Sample
3e11cb3c0f8a62aae331760a08a52482.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e11cb3c0f8a62aae331760a08a52482.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
njrat
0.7.3
Zombie
crackpc424.ddns.net:6522
svchost.exe
-
reg_key
svchost.exe
-
splitter
123
Targets
-
-
Target
3e11cb3c0f8a62aae331760a08a52482
-
Size
448KB
-
MD5
3e11cb3c0f8a62aae331760a08a52482
-
SHA1
1b51873e437c3bd1a60347433f85af3355a5c7ca
-
SHA256
6200c47886500281876a02904d64d2edd143cc58d8042b2cca615a326cd9aa5d
-
SHA512
4bc555458b0641f4fabed65e2e24d47704083432dfdebb647aeb4b026bb86daaa8768b4e022662c658662c398409b17eb03c678ef94297766729989590da2f92
-
SSDEEP
3072:a5rSi9mLPT63Q77NhQGMHphGw+EIsxw8baRYX2NCancRu7AlSfZEPCNHLI0p79LX:GrSi9cPCQ7JTMJvjO9LN5odGw0kaV
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-