General
-
Target
rvcViewModel.exe
-
Size
93KB
-
Sample
240204-pzqqwshfd7
-
MD5
4338e646710fa160b269b2023caf0986
-
SHA1
61a539cb248f92bb50f2b44859e2f903cf39ce46
-
SHA256
0c3e9fed3537035578c17c0ad448f5b59b9f2ce6846a577a7e99e66d84154222
-
SHA512
657443a7b5335bfd45eeb4f8feca30f6fc29fc5af73615523fe3b6faf145a9a0d0ce3d3e5d34a28c9c9885e0d15bcf42a5f014388b0befa107663fe9a8f7d88a
-
SSDEEP
768:/Y3mYLjglPPMJI08+EyrERm9hX+Jl3A461mXxrjEtCdnl2pi1Rz4Rk3xsGdpjgS7:/YngdQ8+f4mXeA4tjEwzGi1dDBDjgS
Malware Config
Extracted
njrat
0.7d
Anonzm
hakim32.ddns.net:2000
127.0.0.1:5552
8fb4bf92409ddd875334dc0e6902736e
-
reg_key
8fb4bf92409ddd875334dc0e6902736e
-
splitter
|'|'|
Targets
-
-
Target
rvcViewModel.exe
-
Size
93KB
-
MD5
4338e646710fa160b269b2023caf0986
-
SHA1
61a539cb248f92bb50f2b44859e2f903cf39ce46
-
SHA256
0c3e9fed3537035578c17c0ad448f5b59b9f2ce6846a577a7e99e66d84154222
-
SHA512
657443a7b5335bfd45eeb4f8feca30f6fc29fc5af73615523fe3b6faf145a9a0d0ce3d3e5d34a28c9c9885e0d15bcf42a5f014388b0befa107663fe9a8f7d88a
-
SSDEEP
768:/Y3mYLjglPPMJI08+EyrERm9hX+Jl3A461mXxrjEtCdnl2pi1Rz4Rk3xsGdpjgS7:/YngdQ8+f4mXeA4tjEwzGi1dDBDjgS
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-