General
-
Target
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5N
-
Size
33KB
-
Sample
241008-1z3k8swbkb
-
MD5
89b59f712fc271a7ea93d447a3cc93c0
-
SHA1
44781d6057f7165508fd2127e9bee36622fc1586
-
SHA256
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5
-
SHA512
91f08e0a11a44d0085ce2aa7eda8cb556510032ab2c2a61a6834e629dde973271d018add27df0b05f2fd7df0177298711f5caeb8db97d9640e6b93fe1b137ced
-
SSDEEP
384:A8aY1ia0N/IH+WUiWiLcXyUTly2Rc87po6ngB8W+tqlf5mRvR6JZlbw8hqIusZzo:F1Re/E+WUiW6ci6NR7tZRpcnuUUFP
Behavioral task
behavioral1
Sample
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
njrat
0.7d
AlbertoScammer
178.162.221.62:80
c20b8e85844937959c801a053d8106ad
-
reg_key
c20b8e85844937959c801a053d8106ad
-
splitter
|'|'|
Targets
-
-
Target
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5N
-
Size
33KB
-
MD5
89b59f712fc271a7ea93d447a3cc93c0
-
SHA1
44781d6057f7165508fd2127e9bee36622fc1586
-
SHA256
9a646486e8f48e6cbf92b22761e68e242fb06e447fd82bfb58de11e8956184f5
-
SHA512
91f08e0a11a44d0085ce2aa7eda8cb556510032ab2c2a61a6834e629dde973271d018add27df0b05f2fd7df0177298711f5caeb8db97d9640e6b93fe1b137ced
-
SSDEEP
384:A8aY1ia0N/IH+WUiWiLcXyUTly2Rc87po6ngB8W+tqlf5mRvR6JZlbw8hqIusZzo:F1Re/E+WUiW6ci6NR7tZRpcnuUUFP
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1