Behavioral task
behavioral1
Sample
f550457c23841e5636aef2469c876087d06a6bb76501a005b66a0a1ac1a6409e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f550457c23841e5636aef2469c876087d06a6bb76501a005b66a0a1ac1a6409e.exe
Resource
win10v2004-20220414-en
General
-
Target
f550457c23841e5636aef2469c876087d06a6bb76501a005b66a0a1ac1a6409e
-
Size
29KB
-
MD5
7746b6783596d71ab36d36e24a843472
-
SHA1
677e119ee72f5b1570380da1e0780941e8b3465c
-
SHA256
f550457c23841e5636aef2469c876087d06a6bb76501a005b66a0a1ac1a6409e
-
SHA512
17e6edeccfb7c546ff7aa32e3078f364eec2f755d5b120bc4b2fcf4b9a3c9095a79811278906c24285760d060c1dc2aa42ea7a57de87e60d3f3eb825eb67d450
-
SSDEEP
384:S78EBl7Bvgk4Xe0err5RhVNaemqDq9xrefTGBsbh0w4wlAokw9OhgOL1vYRGOZzu:SH7Kk4XeP/Fzsq+xre6BKh0p29SgRFs
Malware Config
Extracted
njrat
0.6.4
999
falcon-56657.portmap.host:56657
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
f550457c23841e5636aef2469c876087d06a6bb76501a005b66a0a1ac1a6409e.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ