Behavioral task
behavioral1
Sample
1b8d0eb429085d83d044bb433f7e9fed5e979755a5d694b14834d84a96b360a1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1b8d0eb429085d83d044bb433f7e9fed5e979755a5d694b14834d84a96b360a1.exe
Resource
win10v2004-20220812-en
General
-
Target
1b8d0eb429085d83d044bb433f7e9fed5e979755a5d694b14834d84a96b360a1
-
Size
29KB
-
MD5
c5ec7e08eccb9e3659a19473c3805cf2
-
SHA1
a536ebdb1b93ce744398039317434cff1282dc4a
-
SHA256
1b8d0eb429085d83d044bb433f7e9fed5e979755a5d694b14834d84a96b360a1
-
SHA512
47520a323137357f3d8ce1568c40300bbbdafa9757ad0b24be1a201548428974cbf7d77ee7ea08d3c6474697e75db1d40c06dc52f1860f15796c8149237daf82
-
SSDEEP
384:MRYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZz0:Mx7/skCXkQossqtje3BKh0p29SgRle
Malware Config
Extracted
njrat
0.6.4
HacKed
xoxoyi.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
1b8d0eb429085d83d044bb433f7e9fed5e979755a5d694b14834d84a96b360a1.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ