Behavioral task
behavioral1
Sample
e1b01b98aa6b28d58f970a7325479db49809939b30031a5139bbc711c1e1d385.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1b01b98aa6b28d58f970a7325479db49809939b30031a5139bbc711c1e1d385.exe
Resource
win10v2004-20220812-en
General
-
Target
e1b01b98aa6b28d58f970a7325479db49809939b30031a5139bbc711c1e1d385
-
Size
29KB
-
MD5
3471e8a643f2f4bf8da13e7c6660be11
-
SHA1
f54ea7d6c5e6acb78a2661420cfd7eebbffc6e0e
-
SHA256
e1b01b98aa6b28d58f970a7325479db49809939b30031a5139bbc711c1e1d385
-
SHA512
06019f1f6038a43cd38102dbe8f84e95ad7911c02d7836dec4a304ff6d57e8a3afad5bae88f0690b164a4865dbe7fb0c88ef979ccb675d485f73d67146c58b2d
-
SSDEEP
384:fFpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzJ:fi7hoKoGJFNK4Aq1RehBKh0p29SgRdb
Malware Config
Extracted
njrat
0.6.4
HacKed
127.0.0.1:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
e1b01b98aa6b28d58f970a7325479db49809939b30031a5139bbc711c1e1d385.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ