Behavioral task
behavioral1
Sample
2413b7f8b03acf212c1c9bd092dc8892d74885dc49e2d926d607618f203fa960.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2413b7f8b03acf212c1c9bd092dc8892d74885dc49e2d926d607618f203fa960.exe
Resource
win10v2004-20221111-en
General
-
Target
2413b7f8b03acf212c1c9bd092dc8892d74885dc49e2d926d607618f203fa960
-
Size
28KB
-
MD5
3492d6c98dd85f9abcc6c34cf4491998
-
SHA1
212d4d385f72d7906e3ea7832e5c720dc392021f
-
SHA256
2413b7f8b03acf212c1c9bd092dc8892d74885dc49e2d926d607618f203fa960
-
SHA512
bdfaf0e244355b12ffbf6e473a270d5247fbfb8b0960c1e478b866940956b8eb0088e9bc7699ecd0ada85b250224ba059c538618cf6f2ee4f6a8ffcfc8c66e31
-
SSDEEP
384:WCZ2hJl7tjrMSJIeURd545rCWmqDebDveoEGBsbh0w4wlAokw9OhgOL1vYRGOZzG:VM79MSJ07srcqETe6BKh0p29SgRj+t
Malware Config
Extracted
njrat
0.6.4
Đǿsħka ĦąĈķễr
ahmad-rimawi1998.zapto.org:1188
1ffcf52b0cd64d83554855bd6f04fc1f
-
reg_key
1ffcf52b0cd64d83554855bd6f04fc1f
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
2413b7f8b03acf212c1c9bd092dc8892d74885dc49e2d926d607618f203fa960.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ