Behavioral task
behavioral1
Sample
cf380595e45b974557b1d1e3eac70acd12d8cb3e3b349849925379927d6a3eb6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cf380595e45b974557b1d1e3eac70acd12d8cb3e3b349849925379927d6a3eb6.exe
Resource
win10v2004-20221111-en
General
-
Target
cf380595e45b974557b1d1e3eac70acd12d8cb3e3b349849925379927d6a3eb6
-
Size
29KB
-
MD5
c108e76fdae43d19323cb381a8505198
-
SHA1
5f9211590f246a319795090542e69b5c7c77cb91
-
SHA256
cf380595e45b974557b1d1e3eac70acd12d8cb3e3b349849925379927d6a3eb6
-
SHA512
8497b1a4d7e06545c59b62784586c892f230da831575c3b7d6d0ebbb8cb550f1ce5b22adfc73edd8c490379003c1f9fd91d54bf3c993becaa8780777c7e03df9
-
SSDEEP
384:uzwIpl79TbsiKQ1lZl5Z5n7SWmqDyLXek8GBsbh0w4wlAokw9OhgOL1vYRGOZzo0:uP7tsiKop9n7MqoXeOBKh0p29SgRQN2
Malware Config
Extracted
njrat
0.6.4
Windows
andreastrahan.ddns.net:1604
386657da1e60be4194c71697712e8f87
-
reg_key
386657da1e60be4194c71697712e8f87
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
cf380595e45b974557b1d1e3eac70acd12d8cb3e3b349849925379927d6a3eb6.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ