Behavioral task
behavioral1
Sample
5d403a38a4c07d15bc9eb3474d9ba062.exe
Resource
win7-20220812-en
General
-
Target
5d403a38a4c07d15bc9eb3474d9ba062.exe
-
Size
70KB
-
MD5
5d403a38a4c07d15bc9eb3474d9ba062
-
SHA1
0b398e726834dc8586c0f81ddeed57cfef373105
-
SHA256
b30b94ea18860b2c80328aeffb59c4ba2ab16a101105e8f64236ea935e1ae0a9
-
SHA512
8f44bd3aca30e5d495f2f89a11d84879dd3ccfea7589728c53b00e4eb0be6f89879907f658fce8a2e3ba9502866f82dd1da692a34ce4c24c347a380f70742086
-
SSDEEP
1536:5wws4DnAN7jytFADKwsNMDGXExI3pm6m7drSkJ:WT4DnA2PADKwsNMDGXExI3pmXWc
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
5.tcp.eu.ngrok.io:16130
542a85e2a6506795ed3ab75fd938064a
-
reg_key
542a85e2a6506795ed3ab75fd938064a
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
Files
-
5d403a38a4c07d15bc9eb3474d9ba062.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ