General
-
Target
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c
-
Size
1.2MB
-
Sample
241211-3n3szaxkfj
-
MD5
f45dfec03714aad85cae5ada0ea1f104
-
SHA1
d1f589ed4e83dd4d1ff28c29433cdf9b5c944d88
-
SHA256
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c
-
SHA512
1175cdd12c7ac6ff29be17097dc0e604f89c7550068ee41f3ecfe8daa89cde813269ad1e432bcf6640c57313ba86dd8c92223fceaf4bbaafa8572a789ea19f33
-
SSDEEP
24576:eAHnh+eWsN3skA4RV1Hom2KXMmHaW7aWvCaFg5a7PCmWX950:Jh+ZkldoPK8YaW7CaZ7IH0
Static task
static1
Behavioral task
behavioral1
Sample
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
njrat
0.7d
redlanhopto
redlan.hopto.org:5553
d25d360449d7bab3069e1b77b3a914a3
-
reg_key
d25d360449d7bab3069e1b77b3a914a3
-
splitter
|'|'|
Targets
-
-
Target
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c
-
Size
1.2MB
-
MD5
f45dfec03714aad85cae5ada0ea1f104
-
SHA1
d1f589ed4e83dd4d1ff28c29433cdf9b5c944d88
-
SHA256
800f43358964117f685e3548d0a71d7d519131c3dff3cbf9fe2efb38d29c687c
-
SHA512
1175cdd12c7ac6ff29be17097dc0e604f89c7550068ee41f3ecfe8daa89cde813269ad1e432bcf6640c57313ba86dd8c92223fceaf4bbaafa8572a789ea19f33
-
SSDEEP
24576:eAHnh+eWsN3skA4RV1Hom2KXMmHaW7aWvCaFg5a7PCmWX950:Jh+ZkldoPK8YaW7CaZ7IH0
-
Njrat family
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1