General
-
Target
dllhost.exe
-
Size
93KB
-
MD5
3981bc5841eda6cb5bea733f18711f0a
-
SHA1
c2fa36ddf5583d4d8acb2708d8b99773ba2fc4ce
-
SHA256
5dae5e47219476cfd682ae4a1e7e2e554fb2fccecd1b4fe7569f74ce4e44f097
-
SHA512
2ab52c78a7c3e20773fcf5679c925c413efdde050e568218dac45dd09b960aa3e763eca55932ef4e0723ecb23b533b250562374a9af3733a52ed392b9a756d58
-
SSDEEP
1536:TuwYW6qbkW8aVpO1ARkoojEwzGi1dDiDEgS:Tuk8aVpO2SCi1d09
Malware Config
Extracted
njrat
0.7d
MediaGet
OTFRANSESCOuOTkuFRANSESCOTA0Ljk2:MTc1MjQ=
e16ca4b3ba16d929041c508a1cd98a13
-
reg_key
e16ca4b3ba16d929041c508a1cd98a13
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
dllhost.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ