Behavioral task
behavioral1
Sample
dafc56a5e7e8ea36b8117ad727c59778f1dc0f68e0f9a8266d3b6ae270be9ab2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dafc56a5e7e8ea36b8117ad727c59778f1dc0f68e0f9a8266d3b6ae270be9ab2.exe
Resource
win10v2004-20220901-en
General
-
Target
dafc56a5e7e8ea36b8117ad727c59778f1dc0f68e0f9a8266d3b6ae270be9ab2
-
Size
93KB
-
MD5
540bc9dde5aac4fcb45e6e4d17a6b0cf
-
SHA1
c707857181e10af602bdcfec9cf0c5b411790866
-
SHA256
dafc56a5e7e8ea36b8117ad727c59778f1dc0f68e0f9a8266d3b6ae270be9ab2
-
SHA512
e6c1d478bf1de18a8beee830b7a2403b0258a11387169e0db7582fc3178889edfe16f2cf4fc7330d951bfc288b02d721862cf81db9478bd73e227521ad2bf204
-
SSDEEP
1536:f7nisVm7KhG29jE6v1ggpZJ7WTeXLZXkuwxNa0X2/m/L8wIGcCGzOJHj6:DiAmuA29ztLxWTeKxNhXCpwIrCGzOJHO
Malware Config
Extracted
njrat
0.6.4
Fifa_Vitimas
duduhackernoob.no-ip.org:1177
2e3533e8a21782e85bf5271ce8795feb
-
reg_key
2e3533e8a21782e85bf5271ce8795feb
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
dafc56a5e7e8ea36b8117ad727c59778f1dc0f68e0f9a8266d3b6ae270be9ab2.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ