General
-
Target
ab49fa5533b6feef736c2aae5ca53fa6
-
Size
402KB
-
Sample
240228-ht6rlaea23
-
MD5
ab49fa5533b6feef736c2aae5ca53fa6
-
SHA1
33b67c986a7d330aaffc9c8e06bd33bc8c94289c
-
SHA256
7f9369f1714ee4ef8ac938151fdb3eb7b3032fc74207b6af624987fefac4c947
-
SHA512
f8d07ea61c1baadafc4cc1e1177fc5d452bb028fcd29c29ed41effa27bb40267c43c862f47a1dd5fca6fd7a1cd7381f13c7319b8d44d59ddf74941c516a3ad9f
-
SSDEEP
6144:wmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDge:hSmLAuEY71fviagATFmebVQDcYcq
Behavioral task
behavioral1
Sample
ab49fa5533b6feef736c2aae5ca53fa6.exe
Resource
win7-20240221-en
Malware Config
Extracted
njrat
0.6.4
hhhmach.ddns.net:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
ab49fa5533b6feef736c2aae5ca53fa6
-
Size
402KB
-
MD5
ab49fa5533b6feef736c2aae5ca53fa6
-
SHA1
33b67c986a7d330aaffc9c8e06bd33bc8c94289c
-
SHA256
7f9369f1714ee4ef8ac938151fdb3eb7b3032fc74207b6af624987fefac4c947
-
SHA512
f8d07ea61c1baadafc4cc1e1177fc5d452bb028fcd29c29ed41effa27bb40267c43c862f47a1dd5fca6fd7a1cd7381f13c7319b8d44d59ddf74941c516a3ad9f
-
SSDEEP
6144:wmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDge:hSmLAuEY71fviagATFmebVQDcYcq
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1