Behavioral task
behavioral1
Sample
ZX2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ZX2.exe
Resource
win10v2004-20220901-en
General
-
Target
ZX2.exe
-
Size
32KB
-
MD5
75ead756b5bcc18d72076216622742c5
-
SHA1
72e8cdb401cf395f0461a51939f2bebff5aa2a51
-
SHA256
cbc4c00395ee3d24d1f5a1dd64cfb0b74648f0371a0665287dd8108181e7668b
-
SHA512
c3ae2438d96d639bb890eca0a1da4a189ce3330561103382ea1418e836b77069c0bf5b7a2239a6615b80eab507347e6571279031d42f5e5e038fd4951cdcf790
-
SSDEEP
384:V0bUe5XB4e0XlOVoc6WQzDWTktTUFQqz9QObbO:2T9Bu8ucrQV6bO
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
nyas22.duckdns.org:57831
8521e1f80fc24
-
reg_key
8521e1f80fc24
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
ZX2.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ