General
-
Target
3064-0-0x0000000000490000-0x00000000004A2000-memory.dmp
-
Size
72KB
-
Sample
240126-yeazdadag2
-
MD5
440daccdcfce74046cdb911656a2fd3a
-
SHA1
791ccb83de68b5b153c54cee6e5633ab64876f2a
-
SHA256
ae45c549a1244a17862552057ba6e0ba79c8e33f4ded39d988899eb26bcb0093
-
SHA512
e1f763126539130b98dae1fb881bf84ed5ed4484157f25cfbecef645808ec61cf15a8933d45a197f8b742918ddf9f1ee4631ca0fad5d9e3255981d2ea86bd956
-
SSDEEP
384:iZyELJxV6Lk8yv8L8L+8M1KhfkpYXO9D9O5UE5QzwBlpJNakkjh/TzF7pWnq1grO:QzLJxsY5v48qlKxZvQO+n3+L
Behavioral task
behavioral1
Sample
3064-0-0x0000000000490000-0x00000000004A2000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3064-0-0x0000000000490000-0x00000000004A2000-memory.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
system
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
3064-0-0x0000000000490000-0x00000000004A2000-memory.dmp
-
Size
72KB
-
MD5
440daccdcfce74046cdb911656a2fd3a
-
SHA1
791ccb83de68b5b153c54cee6e5633ab64876f2a
-
SHA256
ae45c549a1244a17862552057ba6e0ba79c8e33f4ded39d988899eb26bcb0093
-
SHA512
e1f763126539130b98dae1fb881bf84ed5ed4484157f25cfbecef645808ec61cf15a8933d45a197f8b742918ddf9f1ee4631ca0fad5d9e3255981d2ea86bd956
-
SSDEEP
384:iZyELJxV6Lk8yv8L8L+8M1KhfkpYXO9D9O5UE5QzwBlpJNakkjh/TzF7pWnq1grO:QzLJxsY5v48qlKxZvQO+n3+L
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-