Behavioral task
behavioral1
Sample
e8ddfbedae550cd57af7bd8bf67f6a3f35a0fe13433d40962d0b4b576f9e9e4c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e8ddfbedae550cd57af7bd8bf67f6a3f35a0fe13433d40962d0b4b576f9e9e4c.exe
Resource
win10v2004-20220812-en
General
-
Target
e8ddfbedae550cd57af7bd8bf67f6a3f35a0fe13433d40962d0b4b576f9e9e4c
-
Size
29KB
-
MD5
9cd7b5268a9331f3ed2ae2e1e7986d60
-
SHA1
aa9078066c738649382bbd1b4b79616b5ef48394
-
SHA256
e8ddfbedae550cd57af7bd8bf67f6a3f35a0fe13433d40962d0b4b576f9e9e4c
-
SHA512
a11116d342ca830193ba6c690cac6db4dae1d5892999b4d8f57f18cbe8b5bb49e8b0a76b3d91285245d313a3c447c977f601212d7415407f81a7b56b6014d548
-
SSDEEP
768:hj77ucYfKQTtzjAqc3eUBKh0p29SgRvM:B7hWVUJZKhG29jvM
Malware Config
Extracted
njrat
0.6.4
HacKed
daninasr190.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
e8ddfbedae550cd57af7bd8bf67f6a3f35a0fe13433d40962d0b4b576f9e9e4c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ