Static task
static1
Behavioral task
behavioral1
Sample
a6c258af41ba4806e49fb1acff81567a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a6c258af41ba4806e49fb1acff81567a.exe
Resource
win10-en-20211208
General
-
Target
a6c258af41ba4806e49fb1acff81567a.exe
-
Size
259KB
-
MD5
a6c258af41ba4806e49fb1acff81567a
-
SHA1
8264f99a54cf67957decd9346bb6e0d3cc91af1e
-
SHA256
75ab761cc1439789376140b0ce2baf9fd7f6090a4a177cfcffd6fae11ec93071
-
SHA512
f21ced4af54da0041bea63316277726529f09af941effd34544d45d5a6e8e52e4eb3a515796715f85cbdd1d39be519ee4952812c10b064d577c4fb2fdcf1f31f
-
SSDEEP
6144:Yj9bQFm0oVhDdXA0EIJ/LW0n+qtQj9i1qE7:YmGrHNW0tH7
Malware Config
Extracted
njrat
v4.0
UziClicker
perpetual-pollution.auto.playit.gg:54523
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
Files
-
a6c258af41ba4806e49fb1acff81567a.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 233KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ