Behavioral task
behavioral1
Sample
4328-275-0x0000000000400000-0x000000000062B000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4328-275-0x0000000000400000-0x000000000062B000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4328-275-0x0000000000400000-0x000000000062B000-memory.dmp
-
Size
2.2MB
-
MD5
fab166024e045673d240995e6e7e9fd5
-
SHA1
ffba042eb32edfcfd32994422f0187c0791867e7
-
SHA256
f9af3deceabc2815dc6e35f2e3edf2bf7b6631fcdaa258b7e19e62a00b85d1e9
-
SHA512
81aae56604e9adea28ff1e803e9c8f5ba8467ef469a4a3ab6ff2287efaa702e045a44f3061acfb8938861c10247d681fc1f1490649abdc4a2b5a8cd8aaa139a5
-
SSDEEP
384:2kLam4PanO4Y7pcdYGiTOCsPodxxM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcaN6l:2y63vc7OQ2A/vMHTi9bD
Malware Config
Extracted
njrat
v2.0
HacKed
45.155.165.74:7778
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
Files
-
4328-275-0x0000000000400000-0x000000000062B000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ