Behavioral task
behavioral1
Sample
4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe
Resource
win10v2004-20220414-en
General
-
Target
4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa
-
Size
37KB
-
MD5
2db8f69266eb3fbda33b18d9c3cc8207
-
SHA1
8502438b2c2cf338e5f37f2b672d0c7628fa6689
-
SHA256
4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa
-
SHA512
0158fbe83619fa6024d04328848161c1c16b94552fdc336bf1b5ef11e8167fd05513ea8f27186cc735ca75a696489f7007f60520842495d9beff3e04945d6a9d
-
SSDEEP
384:B6l+yw7BeAaXaEiVbzdmB0O4yUvNixgp+Z2v/RYJ/oM6IxrAF+rMRTyN/0L+EcoS:gcyw79POTUvNZYv64rM+rMRa8Nu+Ct
Malware Config
Extracted
njrat
im523
HacKed
dy4858.p-e.kr:5050
d470c0a8cff1a8e97a7898f10e5c5234
-
reg_key
d470c0a8cff1a8e97a7898f10e5c5234
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
4fc885705f088e9e40e774189b7d419c0939683ee2de98dc59f819434bc4a3fa.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ