Behavioral task
behavioral1
Sample
bF16.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bF16.exe
Resource
win10v2004-20220812-en
General
-
Target
bF16.exe
-
Size
32KB
-
MD5
2043cff7ffe0498f9718b6925d9cefff
-
SHA1
9a13a021f69ac623e995bb6bb5940506e23422f5
-
SHA256
459339ad24f46b7d4d28e0badbc1eac08f16af67c88ccde5cbd9b4fd99ee46ab
-
SHA512
ca7cd9dcf617a0c75890b7f0f5fbba7901fa32b6fb367f9768397473a3e2bd23fbc3606e84ae146c8bbba437515cc182b3c673ca4a8b16582e1ea676a873d85a
-
SSDEEP
384:Z0bUe5XB4e0XvObaSjgkM8WTCtTUFQqz9A1ObbS:iT9Bum+SjeSHqbS
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
winry7.duckdns.org:8787
9e1ba3b3cf5
-
reg_key
9e1ba3b3cf5
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
bF16.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ