Behavioral task
behavioral1
Sample
bCP8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
bCP8.exe
Resource
win10v2004-20220414-en
General
-
Target
bCP8.exe
-
Size
23KB
-
MD5
6e449b0b98b38524647b74f93d180cd5
-
SHA1
04a51144421253ec992a1d407b3d006849f58e50
-
SHA256
36ec0ed30e8a776d4e7635b565859b28db6262c1772ca082ad1c2c211523547f
-
SHA512
90fcda2f004b021045d88b1cca860f50fb744c68e380cc9fce183a2c26410130454222b55e71867e27e9721bdc9877607e24e4f3e1b1eaa32d2a4dff168d9915
-
SSDEEP
384:psqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZHu:if65K2Yf1jKRpcnuV
Malware Config
Extracted
njrat
0.7d
HacKed
5.tcp.ngrok.io:24566
be8f29d1887fe132d92d7abd370fbfc4
-
reg_key
be8f29d1887fe132d92d7abd370fbfc4
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
bCP8.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ