General
-
Target
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3
-
Size
5.5MB
-
Sample
240410-1pcbascd42
-
MD5
281f913e63ddd7845b3e017ab218ea55
-
SHA1
c74ee249c4c669a3fb5f575563aa02e1a49cd11b
-
SHA256
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3
-
SHA512
cdaff98a9e4503a988076e3f1853fa5df036bf4198bc8bf919270bb3e8b291968c15dc56263c262fa7e1c3b1b1f64c5845e23e1b04874e2c531f602d90221635
-
SSDEEP
98304:2zf+P8T7QgQRw/69DI6kLBhjfY8rAaw6oYpv4vjl9/+g0ShbOrbUOLOxA:wn/6G5DLY866ov9/cbPLOy
Static task
static1
Behavioral task
behavioral1
Sample
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
njrat
0.7d
YT
windows.zezinho.online:1903
01a36ce0605b77f2d1e0b971949ec135
-
reg_key
01a36ce0605b77f2d1e0b971949ec135
-
splitter
|'|'|
Targets
-
-
Target
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3
-
Size
5.5MB
-
MD5
281f913e63ddd7845b3e017ab218ea55
-
SHA1
c74ee249c4c669a3fb5f575563aa02e1a49cd11b
-
SHA256
53ba39bc3d553399cb754206f0d8a47b62c39aa8918ce195b8f010e4a09d77c3
-
SHA512
cdaff98a9e4503a988076e3f1853fa5df036bf4198bc8bf919270bb3e8b291968c15dc56263c262fa7e1c3b1b1f64c5845e23e1b04874e2c531f602d90221635
-
SSDEEP
98304:2zf+P8T7QgQRw/69DI6kLBhjfY8rAaw6oYpv4vjl9/+g0ShbOrbUOLOxA:wn/6G5DLY866ov9/cbPLOy
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1