General
-
Target
ca931abba5ab287d13dbca6726390820_JaffaCakes118
-
Size
43KB
-
Sample
240830-lgwmmsxbjc
-
MD5
ca931abba5ab287d13dbca6726390820
-
SHA1
2756e13f972f6600d8d449fae722e7cb66a50489
-
SHA256
ddf89c93a55df530940c919e192614d8cccdc48e4e870ebfede7c591a74b4153
-
SHA512
08f2fe6cf2a5e62c7fe34ea6515135d56503f61d260804f2043cb956abecb99fd5d1b864aaa010d6b2bed3eec36583dd8036365769a63467dfb6cd29e4e37ebd
-
SSDEEP
384:UZyk3Xn1iDcsyEqtZ3kMu6GEhGyeEtzcIij+ZsNO3PlpJKkkjh/TzF7pWn3greTf:i7XnU4pEqtdkM5aypuXQ/o++L
Behavioral task
behavioral1
Sample
ca931abba5ab287d13dbca6726390820_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ca931abba5ab287d13dbca6726390820_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
92.223.59.169:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
ca931abba5ab287d13dbca6726390820_JaffaCakes118
-
Size
43KB
-
MD5
ca931abba5ab287d13dbca6726390820
-
SHA1
2756e13f972f6600d8d449fae722e7cb66a50489
-
SHA256
ddf89c93a55df530940c919e192614d8cccdc48e4e870ebfede7c591a74b4153
-
SHA512
08f2fe6cf2a5e62c7fe34ea6515135d56503f61d260804f2043cb956abecb99fd5d1b864aaa010d6b2bed3eec36583dd8036365769a63467dfb6cd29e4e37ebd
-
SSDEEP
384:UZyk3Xn1iDcsyEqtZ3kMu6GEhGyeEtzcIij+ZsNO3PlpJKkkjh/TzF7pWn3greTf:i7XnU4pEqtdkM5aypuXQ/o++L
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-