General
-
Target
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
-
Size
76KB
-
Sample
240128-smk7escce4
-
MD5
6add6fa3ea74ffcba90b3630acde5182
-
SHA1
cd202aa598e13a57e6d2bb8c614eb3122d6fb280
-
SHA256
1092849f2f8f3fb0d1f89f0bff367d0a0f1f138fe5eb45b56f0a970b1677e4be
-
SHA512
b57f846773f78fda8ba5c8b4b718d092d9037df788d0ea41954d6170bc1e35391ab10d8d12658b8be26e31a16deb78e665c74d5fdc44d11c8bf8216af3ff794b
-
SSDEEP
1536:I8R7MJTttj9U5XvdKygf7oFOepKmqwBCmDqorCMCX9QKkW:lCftjK5FKZf+OfwcmZ2RX9QLW
Static task
static1
Behavioral task
behavioral1
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
Svchost
95.173.255.238:4444
Windows Defender
-
reg_key
Windows Defender
-
splitter
|Hassan|
Targets
-
-
Target
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
-
Size
76KB
-
MD5
6add6fa3ea74ffcba90b3630acde5182
-
SHA1
cd202aa598e13a57e6d2bb8c614eb3122d6fb280
-
SHA256
1092849f2f8f3fb0d1f89f0bff367d0a0f1f138fe5eb45b56f0a970b1677e4be
-
SHA512
b57f846773f78fda8ba5c8b4b718d092d9037df788d0ea41954d6170bc1e35391ab10d8d12658b8be26e31a16deb78e665c74d5fdc44d11c8bf8216af3ff794b
-
SSDEEP
1536:I8R7MJTttj9U5XvdKygf7oFOepKmqwBCmDqorCMCX9QKkW:lCftjK5FKZf+OfwcmZ2RX9QLW
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-