Behavioral task
behavioral1
Sample
bF3n.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bF3n.exe
Resource
win10v2004-20220901-en
General
-
Target
bF3n.exe
-
Size
32KB
-
MD5
53e55d9dff8b5b2d1027126eb4bc2e41
-
SHA1
084d245da2e89428df88f03f9053ae0e9a07a740
-
SHA256
7a6c5815545f2172e0717732eb817b464b324c7a218b85266d5ccfdb62423cda
-
SHA512
c5f67e0c6e016b6c6dc19562e165dac57322117b43054f4b19c706271e44c27e87c8cdc2788ee4877fdc5d4d84c989ee29c8c711d70bea18b36d60e2ba70dd48
-
SSDEEP
384:+O0bUe5XB4e0XuOlCANuiEO0YaVWTOtTUFQqzFjObbc:+fT9ButYguiEYCtbc
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
adminneiva.duckdns.org:2023
4c458afe72ce420db7
-
reg_key
4c458afe72ce420db7
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
bF3n.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ