Behavioral task
behavioral1
Sample
1df72b646603b5c09d81b94f132d5ffad083b14183367431e6aad3f5919cf3a9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1df72b646603b5c09d81b94f132d5ffad083b14183367431e6aad3f5919cf3a9.exe
Resource
win10v2004-20220812-en
General
-
Target
1df72b646603b5c09d81b94f132d5ffad083b14183367431e6aad3f5919cf3a9
-
Size
257KB
-
MD5
02a25fe5e20b45f5fc16cd06d41b6372
-
SHA1
1cc990676123fa82b679856da4b486dfab8ee268
-
SHA256
1df72b646603b5c09d81b94f132d5ffad083b14183367431e6aad3f5919cf3a9
-
SHA512
3544bef95ef25a505ad4960f4f4a350fc91c6353667bb3d316989ea36aee17d84a49026da18e66863ad0f8c30d6dae838c6c3cd0dc2aeefe1f94224f89879910
-
SSDEEP
6144:0plB08zl6v9XbUPF4MCRvOz1bd1qV7UV6uELXjC:+YylydeNCRvs1bSV7j
Malware Config
Extracted
njrat
0.7d
HacKed
kurdish2000.ddns.net:1177
65646cdd09b392e147fa8b80b8416207
-
reg_key
65646cdd09b392e147fa8b80b8416207
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
1df72b646603b5c09d81b94f132d5ffad083b14183367431e6aad3f5919cf3a9.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ