General
-
Target
snoserV4.exe
-
Size
93KB
-
Sample
241123-3ztz7szkdn
-
MD5
9e828f0df93f5e2497778a8ef5bf800d
-
SHA1
ad325fb4cd00c05f86910915ba86bd20019c1ce0
-
SHA256
8c2d9ceea06bbfe78077656136679b70a250c12a905ce9fa9ba7ce7ec6630ef1
-
SHA512
c41b63467b8eaad58a8137a64e113708944724148751c83bd8eae56a7320101dc8a27f6d577e0bde625a381b946aa53f16d774c5da5a11d27bdbc570fa11a647
-
SSDEEP
1536:/5s28M8anOafNacpQXvjEwzGi1dDtDogS:/5dnOafNac+XUi1dpR
Behavioral task
behavioral1
Sample
snoserV4.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
management-influence.gl.at.ply.gg:58513
4e98a02057d735ac3a6d778cf4c37408
-
reg_key
4e98a02057d735ac3a6d778cf4c37408
-
splitter
|'|'|
Targets
-
-
Target
snoserV4.exe
-
Size
93KB
-
MD5
9e828f0df93f5e2497778a8ef5bf800d
-
SHA1
ad325fb4cd00c05f86910915ba86bd20019c1ce0
-
SHA256
8c2d9ceea06bbfe78077656136679b70a250c12a905ce9fa9ba7ce7ec6630ef1
-
SHA512
c41b63467b8eaad58a8137a64e113708944724148751c83bd8eae56a7320101dc8a27f6d577e0bde625a381b946aa53f16d774c5da5a11d27bdbc570fa11a647
-
SSDEEP
1536:/5s28M8anOafNacpQXvjEwzGi1dDtDogS:/5dnOafNac+XUi1dpR
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1