General
-
Target
Xbox_Checker__Proxyless_.exe
-
Size
24KB
-
Sample
240527-n6kmsabh23
-
MD5
2cdd8262e9cb061656cc21210d95da0f
-
SHA1
04bd68259b6816a4c058dfc49ccb35c137792c7c
-
SHA256
58e79d1476900dcf808dee2c44a8891275f7653a727311ddb2e9c0ec3c2b2332
-
SHA512
59e28387114b1eb1c2df3ffcee60ce36ec9f90309cc9773d9f2a8adbf77c6207abd0cabfd56546f7f97c330550578eb97c9b5d2fdfe9167a20c1bf08f35a7d30
-
SSDEEP
384:LiURxJTt/6ECAaWhy/DHNCZElrP10/ZWtqO7ctJNl/R3G0CTC2PPzkUPeZmt:Lx5tCqxybsU71aWtqO7OZBEVQUPeZs
Behavioral task
behavioral1
Sample
Xbox_Checker__Proxyless_.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Xbox_Checker__Proxyless_.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
njrat
0.7d
aa
41.216.183.206:4209
b5220ab9377f06559b8b4878c21896e6
-
reg_key
b5220ab9377f06559b8b4878c21896e6
-
splitter
|'|'|
Targets
-
-
Target
Xbox_Checker__Proxyless_.exe
-
Size
24KB
-
MD5
2cdd8262e9cb061656cc21210d95da0f
-
SHA1
04bd68259b6816a4c058dfc49ccb35c137792c7c
-
SHA256
58e79d1476900dcf808dee2c44a8891275f7653a727311ddb2e9c0ec3c2b2332
-
SHA512
59e28387114b1eb1c2df3ffcee60ce36ec9f90309cc9773d9f2a8adbf77c6207abd0cabfd56546f7f97c330550578eb97c9b5d2fdfe9167a20c1bf08f35a7d30
-
SSDEEP
384:LiURxJTt/6ECAaWhy/DHNCZElrP10/ZWtqO7ctJNl/R3G0CTC2PPzkUPeZmt:Lx5tCqxybsU71aWtqO7OZBEVQUPeZs
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1