Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
78KB
-
MD5
468c72d54e968e57b570537f5748b388
-
SHA1
4d2e743b0b9544b3dfc81616987acccab704225c
-
SHA256
2854d4e4cf5f08c940c23577a0d39a5f35f5c1bb7879853b9783437e3ae8d419
-
SHA512
45a537913013228901c426f23d9cdd6008be62225fb5510a5d8f6604fccd5f51de4335d0da222db6a7a49a9f5bae89918492818126c1b2829e304f87b8321f10
-
SSDEEP
1536:CNU+7O+rDxDpIS5wpOk3JCK6pFoSXl6fOpd/9nEh9TGMJKR:k0QwpOk5CK64O/9ESMJK
Malware Config
Extracted
njrat
0.7.3
Lime
holabankzgotyoucovered.camdvr.org:1337
Client.exe
-
reg_key
Client.exe
-
splitter
Null5430
Signatures
-
Njrat family
Files
-
file.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ