Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
78KB
-
MD5
a8f793b31189e68ba9550706655e9056
-
SHA1
335b16ece07c693458d000f3ab8e1962198fbac9
-
SHA256
88ffa89a81eb3c9215513ebef351e47293e516b8f7fd63fb3cb18830c2d0564f
-
SHA512
e3970e8505d326221196ddbc52335592b601ed2c65a7a512cda0bc4b0fe38df6ad078978aa17aa54360efdf7a8a0095c4bf8da122ac9f822001801c7b93f4087
-
SSDEEP
1536:DJf+Pl/bHPDpBS5wpOk3JCK6pFoGfm6fOpd/9nEh9TGPaBJIR7:+/7QwpOk5CK6RO/9ESPaBJI5
Malware Config
Extracted
njrat
0.7.3
NEW VBS + NEW TASK 06/10/2022
157.90.140.17:443
Client.exe
-
reg_key
Client.exe
-
splitter
!@#KOREA#@!
Signatures
-
Njrat family
Files
-
file.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ