Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20220812-en
General
-
Target
Server.exe
-
Size
37KB
-
MD5
fe96410454e44a2d067ef10244671c4a
-
SHA1
5ab9c2149edd09789ea9e2e95405e718e6558950
-
SHA256
f9b69a9c45499a4d0d27653b60023b93e95d9d3163844193091c98a2fe4076ea
-
SHA512
c3c611a5f62112a73b3c755b3abad4d519c5b475b9557f69e3d32cba710309532d8ab3c4415a9e85c3b8a4fc6d847682a61c353f02565c4e4337a1aa7c91a1df
-
SSDEEP
384:aAM6ik1RxdDsyNyysz16ZP5082+b8rAF+rMRTyN/0L+EcoinblneHQM3epzXhlND:RFeyNBsz16ZSF+4rM+rMRa8NupLt
Malware Config
Extracted
njrat
im523
pider
4.tcp.eu.ngrok.io:14835
15602d2416840c9b552ff5d0546f9ba6
-
reg_key
15602d2416840c9b552ff5d0546f9ba6
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
Server.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ