Behavioral task
behavioral1
Sample
64827ef4f067536855cba4035d6bcd214a8ea3a09a1e9a00a72c2cea9fe64a0b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
64827ef4f067536855cba4035d6bcd214a8ea3a09a1e9a00a72c2cea9fe64a0b.exe
Resource
win10v2004-20220812-en
General
-
Target
64827ef4f067536855cba4035d6bcd214a8ea3a09a1e9a00a72c2cea9fe64a0b
-
Size
29KB
-
MD5
84bde0223462ac4be97527abdae162a0
-
SHA1
60467ce1a8e5d9ca878b02c37c2f625b81dcd532
-
SHA256
64827ef4f067536855cba4035d6bcd214a8ea3a09a1e9a00a72c2cea9fe64a0b
-
SHA512
d77964d70dc6b80084c718c3a690e838b82c04eb22ce4edffc0c5cb2291f4fe0412e0f1dddec552a632ad8000cd25f5b36a741b1c0258faf8cc080529fbaf50a
-
SSDEEP
384:j8EBl7Bvgk4Xe0elD5FochNGem/DUb3neUEGBsbh0w4wlAokw9OhgOL1vYRGOZzG:/7Kk4XePlFXY/4bneWBKh0p29SgRMb
Malware Config
Extracted
njrat
0.6.4
НОВЫЕ
niks123.no-ip.biz:777
0834daba34fc76fcb705a66b2338d64f
-
reg_key
0834daba34fc76fcb705a66b2338d64f
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
64827ef4f067536855cba4035d6bcd214a8ea3a09a1e9a00a72c2cea9fe64a0b.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ