Behavioral task
behavioral1
Sample
1a32989d5a4f6d15588242f1ef8a22d8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a32989d5a4f6d15588242f1ef8a22d8.exe
Resource
win10v2004-20220812-en
General
-
Target
1a32989d5a4f6d15588242f1ef8a22d8.exe
-
Size
23KB
-
MD5
1a32989d5a4f6d15588242f1ef8a22d8
-
SHA1
02d933d2513fa70a46ca89082027752b6db2d899
-
SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d
-
SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620
-
SSDEEP
384:cDQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZcDq:cU5yBVd7Rpcnu2
Malware Config
Extracted
njrat
0.7d
Lammer
donaldsvip1234.ddns.net:1177
b37250e28d5e084b62b0aec8b915940b
-
reg_key
b37250e28d5e084b62b0aec8b915940b
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
1a32989d5a4f6d15588242f1ef8a22d8.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ