Behavioral task
behavioral1
Sample
b5ffc0ab332113ab95ea9bf41b3a0cdbc910f9a0b34e430a040de6c3894cbfe2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5ffc0ab332113ab95ea9bf41b3a0cdbc910f9a0b34e430a040de6c3894cbfe2.exe
Resource
win10v2004-20220812-en
General
-
Target
b5ffc0ab332113ab95ea9bf41b3a0cdbc910f9a0b34e430a040de6c3894cbfe2
-
Size
23KB
-
MD5
05f13cc1e24422d180f753f554ebc9a0
-
SHA1
f108dd442ff521df32a2834af053ca0b8ca69a8e
-
SHA256
b5ffc0ab332113ab95ea9bf41b3a0cdbc910f9a0b34e430a040de6c3894cbfe2
-
SHA512
2dd588cc7bbab0d09274b0f362f4b08437add7dbb86077da36215aa5943c0ad442b16e8636416566decc954ef885ebbde547bb19eaaf21f6c526781ed6d90c77
-
SSDEEP
384:oQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZdR:f5yBVd7Rpcnus
Malware Config
Extracted
njrat
0.7d
New
johnnypeace.no-ip.org:1177
128fd52cdc029cd02cb6f842bebc794a
-
reg_key
128fd52cdc029cd02cb6f842bebc794a
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
b5ffc0ab332113ab95ea9bf41b3a0cdbc910f9a0b34e430a040de6c3894cbfe2.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ