Behavioral task
behavioral1
Sample
f3ac0e86a940b514a174dbf30220359de39af4223df9ac8782767e24b15cddf8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f3ac0e86a940b514a174dbf30220359de39af4223df9ac8782767e24b15cddf8.exe
Resource
win10v2004-20220901-en
General
-
Target
f3ac0e86a940b514a174dbf30220359de39af4223df9ac8782767e24b15cddf8
-
Size
33KB
-
MD5
36e58bde7e283bb06766e581694a76d0
-
SHA1
56fdbadb1b76cda33be43a75e57e7d8b4e746e9a
-
SHA256
f3ac0e86a940b514a174dbf30220359de39af4223df9ac8782767e24b15cddf8
-
SHA512
b5e4810db6c0b091ea90548bcd55bbbe741976663ba8f18e5b049a3faaff35a7f41e133ba143792ec06fd90d9cafec6c22f5b976d3bcd9fabfe79f0b229d344d
-
SSDEEP
384:CweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZ2AD/S9daJK:9Lq411eRpcnuImuJK
Malware Config
Extracted
njrat
0.7d
hey
audqkr1311.codns.com:1192
f30b5f124d58c3dd0dcda339b343d839
-
reg_key
f30b5f124d58c3dd0dcda339b343d839
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
f3ac0e86a940b514a174dbf30220359de39af4223df9ac8782767e24b15cddf8.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ