Behavioral task
behavioral1
Sample
375bc488f150781ef73a88ff0b119a754e6f1f59c07c7cee9e9b7fc1d6611ede.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
375bc488f150781ef73a88ff0b119a754e6f1f59c07c7cee9e9b7fc1d6611ede.exe
Resource
win10v2004-20220812-en
General
-
Target
375bc488f150781ef73a88ff0b119a754e6f1f59c07c7cee9e9b7fc1d6611ede
-
Size
23KB
-
MD5
cc0d7079fce54b90a7c6bda318529fbd
-
SHA1
87098b05653157032f6f2339aa3dd3aebcece1a5
-
SHA256
375bc488f150781ef73a88ff0b119a754e6f1f59c07c7cee9e9b7fc1d6611ede
-
SHA512
fd38d6a63e9b0b049386e154120c8385e0b034f9f119445932ebc3c49ad1df2ffefcb7e5c11afbb432d421e7308b9158ab0c93338acb838db07a9ba6dbec4e8c
-
SSDEEP
384:eV8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZ7H:edY+sNKqNHnSdRpcnus
Malware Config
Extracted
njrat
0.7d
pipo
hamilessel.ddns.net:5552
47c3d7f065c14d3666eb9363a4363c50
-
reg_key
47c3d7f065c14d3666eb9363a4363c50
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
375bc488f150781ef73a88ff0b119a754e6f1f59c07c7cee9e9b7fc1d6611ede.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ