Behavioral task
behavioral1
Sample
2bf0f638224e306a99420932175be8bcd8ac26311a964d65c385cc7915689666.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2bf0f638224e306a99420932175be8bcd8ac26311a964d65c385cc7915689666.exe
Resource
win10v2004-20220414-en
General
-
Target
2bf0f638224e306a99420932175be8bcd8ac26311a964d65c385cc7915689666
-
Size
301KB
-
MD5
5e04a9f2d48e007fc7ee5e06fb7a3613
-
SHA1
e3123b48a526b357d773b606916eaeedaf7ee437
-
SHA256
2bf0f638224e306a99420932175be8bcd8ac26311a964d65c385cc7915689666
-
SHA512
0bfb8f050727c5a651a56b7dc6131412dc940252aa115c9adc6ee9462a5ef9e8acdb03617b0d6110d6fe6fcda5214310f9f496d8f78821455e2f457a80a5af14
-
SSDEEP
1536:FCGVtk7ybZGfWXerXBatOuEUr2f1KVs9fl98GfAX71oM3xWy0gJjLcJ8Cx+y58iB:Autk7ybZGfWuVU46s9thgcLxZxHH
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
2bf0f638224e306a99420932175be8bcd8ac26311a964d65c385cc7915689666.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ