Behavioral task
behavioral1
Sample
4a1243fc6a932e037763c7f564ea640e.exe
Resource
win7-20221111-en
General
-
Target
4a1243fc6a932e037763c7f564ea640e.exe
-
Size
31KB
-
MD5
4a1243fc6a932e037763c7f564ea640e
-
SHA1
ee18a9f286ebcdedd15701af7fd312300c75ca6e
-
SHA256
c21a4d4a8c9dc27845e347a3887962ff0b3412c5f6f810a5906ca12957734d82
-
SHA512
bb7d80b8f58b5ce9c935a471c017467a7825faba3630e646523e978cb1cbe5102f6c750807d5b5ded9e104935a2664e92116d093efe05330838c0a078f99227c
-
SSDEEP
768:SVnTaey+VfJFozxzC/krevIz5vApQmIDUu0tiQtj:cmuaJB0QVkpj
Malware Config
Extracted
njrat
0.7d
MyBotTC
tcp.ap.ngrok.io:13864
dc13d94d50e82d82de981c0e84da98fa
-
reg_key
dc13d94d50e82d82de981c0e84da98fa
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
Files
-
4a1243fc6a932e037763c7f564ea640e.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ