General
-
Target
NjRat 0.7D Horror Edition.rar
-
Size
18.9MB
-
Sample
240426-lg5wbadf26
-
MD5
3722a5d14e004bb1e90d0e850366e1ec
-
SHA1
a98916f7add8e783d6646d37680651ca4412220c
-
SHA256
a36807ff99bde01f1d887e6f73d92b1c21a2049726a7d7555845e8f8639c05c1
-
SHA512
7caac7e5a40f88f6757b8beae3c35b1db536008224f9bd15bb67f45521c95c35b3e400a2c828e70a8caaf0d3e90357f5c38ff535b439958bc9eee2d809549724
-
SSDEEP
393216:Bo88DkvZ+wNiWtRReJJB4PWjoNkcZ/aeeV97uVrr0mf26YiPqDKT9:BoVDYiQRRet46UC2fnYEqs9
Static task
static1
Behavioral task
behavioral1
Sample
NjRat 0.7D Horror Edition.rar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
NjRat 0.7D Horror Edition.rar
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
NjRat 0.7D Horror Edition.rar
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
NjRat 0.7D Horror Edition.rar
Resource
win11-20240412-en
Malware Config
Extracted
xworm
5.0
html-nl.gl.at.ply.gg:38534
cyG6dP3JpX7QpOYW
-
Install_directory
%Temp%
-
install_file
XWorm V5.2.exe
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
127.0.0.1:6522
b6f83ebf0bce1d5c2e2e278edaabc64b
-
reg_key
b6f83ebf0bce1d5c2e2e278edaabc64b
-
splitter
Y262SUCZ4UJJ
Targets
-
-
Target
NjRat 0.7D Horror Edition.rar
-
Size
18.9MB
-
MD5
3722a5d14e004bb1e90d0e850366e1ec
-
SHA1
a98916f7add8e783d6646d37680651ca4412220c
-
SHA256
a36807ff99bde01f1d887e6f73d92b1c21a2049726a7d7555845e8f8639c05c1
-
SHA512
7caac7e5a40f88f6757b8beae3c35b1db536008224f9bd15bb67f45521c95c35b3e400a2c828e70a8caaf0d3e90357f5c38ff535b439958bc9eee2d809549724
-
SSDEEP
393216:Bo88DkvZ+wNiWtRReJJB4PWjoNkcZ/aeeV97uVrr0mf26YiPqDKT9:BoVDYiQRRet46UC2fnYEqs9
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-