Behavioral task
behavioral1
Sample
DangerousPayload.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
DangerousPayload.exe
Resource
win10v2004-20220722-en
General
-
Target
DangerousPayload.exe
-
Size
37KB
-
MD5
9bbb2f1dc80afe6ecf27b31794a02d32
-
SHA1
bac66f84175fe186c478a340c2f31fde5f57d980
-
SHA256
7aa11361505f0ea1e8bf02e1529a5104f8186da3d52f26409281f6d4783bc77f
-
SHA512
341ff7add58a74c3aef78340e6c44ae05b8c8b0ba16c0d3d20a668f2923550faee171563bc8541ff0ef956002609bdda4337a484d470fca6528237bc170aac3e
-
SSDEEP
384:Ga5siDlT95hL5YyUvjh/xOi4aaF3ArAF+rMRTyN/0L+EcoinblneHQM3epzXGNrt:DHv5zUvjhDlaRArM+rMRa8NuM1t
Malware Config
Extracted
njrat
im523
HacKed
susiahat24199a.ddns.net:5552
b94fe95343d85bb18dd50d099af4eb73
-
reg_key
b94fe95343d85bb18dd50d099af4eb73
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
DangerousPayload.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ