General
-
Target
20B6DB4A05D7BE590AE26A9E373C7708.exe
-
Size
23KB
-
Sample
240221-13xjdsga6z
-
MD5
20b6db4a05d7be590ae26a9e373c7708
-
SHA1
7982c41e1b4c9bed0efb839a2d09e2134bf4c071
-
SHA256
a03e517dd3772d7f304c77676c7cb50e5dbf146d67a4812eb2bf7ec9a9641520
-
SHA512
0a9e1fa29e54cff6312a4d1b92c8978b6e934d940601c70896996fcb5144d603b6ab1fee1a78c55a29fb7f4c7d31fdcb0a462fd90882605119b2d2158273b8d3
-
SSDEEP
384:Jc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZnV:7e9EJLN/yRpcnuq
Behavioral task
behavioral1
Sample
20B6DB4A05D7BE590AE26A9E373C7708.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20B6DB4A05D7BE590AE26A9E373C7708.exe
Resource
win10v2004-20240221-en
Malware Config
Extracted
njrat
0.7d
Hacked
amma.myftp.biz:1177
5067798511594293a736c9b0b92fa333
-
reg_key
5067798511594293a736c9b0b92fa333
-
splitter
|'|'|
Targets
-
-
Target
20B6DB4A05D7BE590AE26A9E373C7708.exe
-
Size
23KB
-
MD5
20b6db4a05d7be590ae26a9e373c7708
-
SHA1
7982c41e1b4c9bed0efb839a2d09e2134bf4c071
-
SHA256
a03e517dd3772d7f304c77676c7cb50e5dbf146d67a4812eb2bf7ec9a9641520
-
SHA512
0a9e1fa29e54cff6312a4d1b92c8978b6e934d940601c70896996fcb5144d603b6ab1fee1a78c55a29fb7f4c7d31fdcb0a462fd90882605119b2d2158273b8d3
-
SSDEEP
384:Jc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZnV:7e9EJLN/yRpcnuq
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1