Behavioral task
behavioral1
Sample
8471ed8487949236e3d287099de1f4ec51c221ac4e7abe498f33f641f6830e0f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8471ed8487949236e3d287099de1f4ec51c221ac4e7abe498f33f641f6830e0f.exe
Resource
win10v2004-20221111-en
General
-
Target
8471ed8487949236e3d287099de1f4ec51c221ac4e7abe498f33f641f6830e0f
-
Size
23KB
-
MD5
c1f591b4e09f903010742ea543637df7
-
SHA1
2ade96debbe3e18af6ce983c17628112042e6aac
-
SHA256
8471ed8487949236e3d287099de1f4ec51c221ac4e7abe498f33f641f6830e0f
-
SHA512
3a7913f0f9a25a94ca1ca2e15e5999ed87290d44d5c7e22fdb0e9ba967a17924e2b32266d4ec6b13425683c7f5eb82126f12ec96ec0a017435d0323298663f5e
-
SSDEEP
384:WsqCm6yocx/Yp7jemiO0nd08/VQ6bgNQC5h7tmRvR6JZlbw8hqIusZzZDzC:RSoQA6mlcrRpcnuF
Malware Config
Extracted
njrat
0.7d
New
fafsad.duckdns.org:5552
a53304c21c9656176a4aa7909f3682c5
-
reg_key
a53304c21c9656176a4aa7909f3682c5
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
8471ed8487949236e3d287099de1f4ec51c221ac4e7abe498f33f641f6830e0f.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ