Behavioral task
behavioral1
Sample
0x0007000000005c51-56.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0x0007000000005c51-56.exe
Resource
win10v2004-20220414-en
General
-
Target
0x0007000000005c51-56.dat
-
Size
26KB
-
MD5
24bf1ae1d62be5e1283fc4ddc9110dd9
-
SHA1
7b60b080982e77eb4565dce877236297280fcf36
-
SHA256
55cc06f563e305e118f8d9d6307e88de5f802cd36f6bdf394e17b95bf852bd69
-
SHA512
b0b1228c90ac6f795c3ee641c94045023cfc8fea0dba82c37c382cc91376c3b03ca0900c82881d9c8d99363a4fdeca4e8bc758c47730444195d0c52703bef391
-
SSDEEP
384:+Li+lYHHeIYTzJRcbg8iZPPt9hMl7AQk93vmhm7UMKmIEecKdbXTzm9bVhcarmr1:oimZxJmhl7A/vMHTi9bD
Malware Config
Extracted
njrat
v2.0
System
2.tcp.ngrok.io:13817
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
Files
-
0x0007000000005c51-56.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ