Behavioral task
behavioral1
Sample
336-60-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
336-60-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
336-60-0x0000000000400000-0x000000000040C000-memory.dmp
-
Size
48KB
-
MD5
7aa4c18fd7a6b154d3ccfe23536c4483
-
SHA1
33a115d67d1d1dc2b3d563a4da2b7006ad45c344
-
SHA256
5de2bbaf536c85921962050e2829b9da6daf13f805768a665e117f70aad31549
-
SHA512
9b31214813f4a0145938edc4cf0586286844bc2180e3ec9f68696cc2d00a2d3c4d1ec24f86f5a781bc507cc6244516ea82616f51ac3dcf2f3199f734339310f2
-
SSDEEP
384:V0NJLSXLSNB/aCxbWEFdc0//34LAZSTDHn:V0NY7EvdHqtn
Malware Config
Extracted
njrat
0.7d
PikoPiko
pikopiko.ddns.net:2512
165d6ed988ac
-
reg_key
165d6ed988ac
-
splitter
sikora
Signatures
-
Njrat family
Files
-
336-60-0x0000000000400000-0x000000000040C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ