General
-
Target
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe
-
Size
93KB
-
Sample
241217-espj5szpbz
-
MD5
173883b31d172e5140f98fd0e927ff10
-
SHA1
1e477ebc749e1ef65c820cfb959d96ffc058b587
-
SHA256
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08
-
SHA512
01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a
-
SSDEEP
1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngS:XFJMnnwlOUWT0hi1dzg
Behavioral task
behavioral1
Sample
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
njrat
0.7d
dock
hakim32.ddns.net:2000
127.0.0.1:555
c772fa1f7fc98d866443249d79c0b299
-
reg_key
c772fa1f7fc98d866443249d79c0b299
-
splitter
|'|'|
Targets
-
-
Target
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08.exe
-
Size
93KB
-
MD5
173883b31d172e5140f98fd0e927ff10
-
SHA1
1e477ebc749e1ef65c820cfb959d96ffc058b587
-
SHA256
984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08
-
SHA512
01d262922177e746898cfdf9fee9d7b85a273ff43d445cf40f5ee989b51a08bfe71eb270b501a164192565666e4aaef701cbf6594e89c152d9acc43ca881c56a
-
SSDEEP
1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngS:XFJMnnwlOUWT0hi1dzg
-
Njrat family
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1