Behavioral task
behavioral1
Sample
c79e513534e7e1212fd97b873736877a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c79e513534e7e1212fd97b873736877a.exe
Resource
win10v2004-20221111-en
General
-
Target
c79e513534e7e1212fd97b873736877a.exe
-
Size
27KB
-
MD5
c79e513534e7e1212fd97b873736877a
-
SHA1
bfb15c52f234b859c7c47184eba9ce0911ee4521
-
SHA256
4987c9aaf91cd5df19c04072ef25a45094a8e85984ce2eb18547bdc1e4869628
-
SHA512
f7f353d8480f5c53b7c61e391fc8048f55475a4d28f0cf067c2ba67e854627f62663e17d549ee2ca3eef60bc83e621670e387b7425e482a1f3648c4afea9aa15
-
SSDEEP
384:TL0xvKYeA0NEVqnAf+KZgPaWmIjMJAQk93vmhm7UMKmIEecKdbXTzm9bVhcaH6m1:3AKhMEgJA/vMHTi9bD
Malware Config
Extracted
njrat
v2.0
DumbHacKedVicTim
6.tcp.ngrok.io:19493
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
Files
-
c79e513534e7e1212fd97b873736877a.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ