General
-
Target
abc.exe
-
Size
23KB
-
Sample
231223-qe7z4sbafk
-
MD5
f4effd63135d3f09684ef49b7487e098
-
SHA1
e813f6ea685aefb0ac14ce76bd18e91b86e80287
-
SHA256
ac813b5563a46ebd1eb04d6c67c835de8708b6aeed4e8b79ef45924642e5da5f
-
SHA512
5cc302251d9a8d5eac74d2ec95423ad8937406e85e73e426e46ed62907fb1a54d89e65f88ceb415864ec9430081b205fbf6e8c270e34e0354f06b7b7a9f39997
-
SSDEEP
384:aMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZ1a:0OaxVULRpcnu/
Behavioral task
behavioral1
Sample
abc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
abc.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
njrat
0.7d
abc
troi.southcentralus.cloudapp.azure.com:9091
073cd5c901f7aa25f5a10ffbf9e76477
-
reg_key
073cd5c901f7aa25f5a10ffbf9e76477
-
splitter
|'|'|
Targets
-
-
Target
abc.exe
-
Size
23KB
-
MD5
f4effd63135d3f09684ef49b7487e098
-
SHA1
e813f6ea685aefb0ac14ce76bd18e91b86e80287
-
SHA256
ac813b5563a46ebd1eb04d6c67c835de8708b6aeed4e8b79ef45924642e5da5f
-
SHA512
5cc302251d9a8d5eac74d2ec95423ad8937406e85e73e426e46ed62907fb1a54d89e65f88ceb415864ec9430081b205fbf6e8c270e34e0354f06b7b7a9f39997
-
SSDEEP
384:aMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZ1a:0OaxVULRpcnu/
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1