Behavioral task
behavioral1
Sample
01f7229ba382cbab504cb366b65a470ed56f09beef90e51267f10f1c1074a8aa.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
01f7229ba382cbab504cb366b65a470ed56f09beef90e51267f10f1c1074a8aa.exe
Resource
win10v2004-20220901-en
General
-
Target
01f7229ba382cbab504cb366b65a470ed56f09beef90e51267f10f1c1074a8aa
-
Size
29KB
-
MD5
1b863d2348b5c213e3e4c49eed84d62d
-
SHA1
ad81c9dbbd9e556acba3ffdf3b8dd592cb9dc104
-
SHA256
01f7229ba382cbab504cb366b65a470ed56f09beef90e51267f10f1c1074a8aa
-
SHA512
24463c00567a6ffe25c7cefbba4b07d44bca90416c4d7b5b9c8c4eb89fa5aab3545f1453f66e5e371ef2de862c2ef336db59824d227fdb6cbddc25a07e57d894
-
SSDEEP
384:VRYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZz0:Vx7/skCXkQossqtje3BKh0p29SgRdi
Malware Config
Extracted
njrat
0.6.4
HacKed
arivan.no-ip.biz:1155
46d93431630fc8e404fed7204e708738
-
reg_key
46d93431630fc8e404fed7204e708738
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
01f7229ba382cbab504cb366b65a470ed56f09beef90e51267f10f1c1074a8aa.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ