Behavioral task
behavioral1
Sample
60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38.exe
Resource
win10v2004-20220812-en
General
-
Target
60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38.exe
-
Size
43KB
-
MD5
e6b50e399eeb427f01dfec104e8cda5a
-
SHA1
1f9bc5d2d8992df42e9ac9e784a346fe4185edbb
-
SHA256
60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38
-
SHA512
c6ddf9b3731400545e86779777c429eb4cfdba9b0c33eaec526a90641078c3dc7731162c6f490208731af89108e8ee5205826abc82e7ca40ca79326a40ed5ba6
-
SSDEEP
384:YZy0sYz/wpa9GP4Uy2Jd670AwEo6lhSzIIij+ZsNO3PlpJKkkjh/TzF7pWnPMgra:uLsKR4gh2vsNI6YuXQ/oW4+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
???????
7.tcp.eu.ngrok.io:11394
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
Files
-
60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ