Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1243.exe
-
Size
292KB
-
Sample
241222-td2cqaspex
-
MD5
0537a39ec65bcbd5a1b1501ec57cf2b4
-
SHA1
7e8dfbfafcc6795ecb1dffb2ae3267f325a77375
-
SHA256
b8e4e2776a0d1ddef193326e960d1a0e11d6489610595faa13f57c33103b95a7
-
SHA512
43dbaaf81e602bfb8b02763b4936157440ed9d301f789903199b21bbcd0da7cf94398e17cc579b887780452284c70a3e1bf8567d65dae5626c655c0c460f0b63
-
SSDEEP
6144:hrYOdblgpFGv4oO6dcwnOZ4YXo0x9PEfxwQCRW:h5OFGwvKc+leh+RD
Static task
static1
Behavioral task
behavioral1
Sample
1243.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1243.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
fat-pads.gl.at.ply.gg:35059
e564aa028dc627deeaa119b78ed54d5e
-
reg_key
e564aa028dc627deeaa119b78ed54d5e
-
splitter
Y262SUCZ4UJJ
Targets
-
-
Target
1243.exe
-
Size
292KB
-
MD5
0537a39ec65bcbd5a1b1501ec57cf2b4
-
SHA1
7e8dfbfafcc6795ecb1dffb2ae3267f325a77375
-
SHA256
b8e4e2776a0d1ddef193326e960d1a0e11d6489610595faa13f57c33103b95a7
-
SHA512
43dbaaf81e602bfb8b02763b4936157440ed9d301f789903199b21bbcd0da7cf94398e17cc579b887780452284c70a3e1bf8567d65dae5626c655c0c460f0b63
-
SSDEEP
6144:hrYOdblgpFGv4oO6dcwnOZ4YXo0x9PEfxwQCRW:h5OFGwvKc+leh+RD
Score10/10-
Njrat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-