Behavioral task
behavioral1
Sample
623d4dd3ed070850f326dd90961492b2fcbc595c9452305f8a03deab5049e28c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
623d4dd3ed070850f326dd90961492b2fcbc595c9452305f8a03deab5049e28c.exe
Resource
win10v2004-20220812-en
General
-
Target
623d4dd3ed070850f326dd90961492b2fcbc595c9452305f8a03deab5049e28c
-
Size
29KB
-
MD5
c3be01cb93cab807034d7bef80384dae
-
SHA1
8333263054028680b0ca1c8ca98119df48c648a9
-
SHA256
623d4dd3ed070850f326dd90961492b2fcbc595c9452305f8a03deab5049e28c
-
SHA512
f144b9a1dd89a80b05f55c5c78b6a124b5ecf87eeb8450f6fe8694dacd64598e0976d6aa5a5b45a46057a302a28a8cc2ec04e0d6606ad9cba2cf85c407917f2d
-
SSDEEP
384:USItl77FDFucYfKQCcHN5vljmOmqDIlXHeHNGBsbh0w4wlAokw9OhgOL1vYRGOZo:W77ucYfKQTtzjAqc3eUBKh0p29SgRqf
Malware Config
Extracted
njrat
0.6.4
pepo
heseen2012.no-ip.biz:1177
fd44f77e1e93d50245b3f3533969d472
-
reg_key
fd44f77e1e93d50245b3f3533969d472
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
623d4dd3ed070850f326dd90961492b2fcbc595c9452305f8a03deab5049e28c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ