General
-
Target
6f500a8c813768970ecd8005fcd73d1fc6072abaf4444c2e91bfafc12326d82c
-
Size
11KB
-
Sample
240419-vae6rahf36
-
MD5
1a375b6d3dd8d0eabcfa236b17834cd9
-
SHA1
cb2f4e312a3ee277b7dc0e0cdd6ff578d048566d
-
SHA256
6f500a8c813768970ecd8005fcd73d1fc6072abaf4444c2e91bfafc12326d82c
-
SHA512
5842c680af1dcb453ca00b23da431df563444dd68a11a27d99987de5afc74bb038ef13b66d23e73572c8ad54c8b65358b2610333aa739035240032f811e0c1d9
-
SSDEEP
192:3VALiPymC1QLgHq2trmo5RcK5/ENaa48GAQjDC4FAMInjf9h3QX/JRIvEgi:mLiPymVh0XrbFQaaxNQjDC4FAMEf96m6
Behavioral task
behavioral1
Sample
db2d6aba09d4cf989368749a1caa77e4cdcf097dba60cfe618ae875a06415356.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
db2d6aba09d4cf989368749a1caa77e4cdcf097dba60cfe618ae875a06415356.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
njrat
0.7d
HacKed
electric-guest.gl.at.ply.gg:30641
f137f44344434ce16249d5d6a380e154
-
reg_key
f137f44344434ce16249d5d6a380e154
-
splitter
|'|'|
Targets
-
-
Target
db2d6aba09d4cf989368749a1caa77e4cdcf097dba60cfe618ae875a06415356.exe
-
Size
23KB
-
MD5
0ce053cc9d92096131772f181234b484
-
SHA1
e9d1827076d4fa4dbc25de3d69487a37f01b13f5
-
SHA256
db2d6aba09d4cf989368749a1caa77e4cdcf097dba60cfe618ae875a06415356
-
SHA512
241f5eff6ede94aab10acca79837cc46c5963b881d581a6a6ccf9c1b32c89342109187e46e526bd20ba17297430c12971e406db7951765c38d3f0e3c712cb2e9
-
SSDEEP
384:WluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZBs:ZOmhtIiRpcnuR
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1