Behavioral task
behavioral1
Sample
dbfadddbe24ee459e7aac3c6937748b3d60e0f9547b77bdc1a582f2c7aba8838.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dbfadddbe24ee459e7aac3c6937748b3d60e0f9547b77bdc1a582f2c7aba8838.exe
Resource
win10-en-20211208
General
-
Target
dbfadddbe24ee459e7aac3c6937748b3d60e0f9547b77bdc1a582f2c7aba8838
-
Size
78KB
-
MD5
7ab3c97a8dcf771d4279407882118889
-
SHA1
c57f92cff68befeeb9286ec6d85ef8fc9ae728c7
-
SHA256
dbfadddbe24ee459e7aac3c6937748b3d60e0f9547b77bdc1a582f2c7aba8838
-
SHA512
0d94699da5bc986f56711cd3e90944bbb31b0084a66b931d2a1a00c334162a5411a70854c328045cbef55edafcd2f79b3c2ced1c39d45eeac176c773d0003744
-
SSDEEP
1536:ApIXx+1CmsDp2S5wpOk3JCK6pFoQTQ6fOpd/9nEh9TGZJZR:BMQwpOk5CK61O/9ESZJZ
Malware Config
Extracted
njrat
0.7.3
Pilonera
FESTIVALDEAMOR.PUBLICVM.COM:1407
Client.exe
-
reg_key
Client.exe
-
splitter
1234
Signatures
-
Njrat family
Files
-
dbfadddbe24ee459e7aac3c6937748b3d60e0f9547b77bdc1a582f2c7aba8838.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ