Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Generic-0efaae5b89cc78d6c04774d89aaea91010a7c4c8e614e83417446ad0ce89dc9e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.Generic-0efaae5b89cc78d6c04774d89aaea91010a7c4c8e614e83417446ad0ce89dc9e.exe
Resource
win10v2004-20221111-en
General
-
Target
HEUR-Trojan.Win32.Generic-0efaae5b89cc78d6c04774d89aaea91010a7c4c8e614e83417446ad0ce89dc9e.exe
-
Size
37KB
-
MD5
ae5724366393da812eb1f651c879e035
-
SHA1
c5b208db86b88fd3716d6d13d1689be5c45f80bd
-
SHA256
0efaae5b89cc78d6c04774d89aaea91010a7c4c8e614e83417446ad0ce89dc9e
-
SHA512
77537b7d1b6e460c394689240d01e6d29eb84d13cbc2b4bc0f5769a60e22218f6221be1394f231be3c6d46b80f87d7ff0bb2c54f81c74c7fa1be5e26d9cc496d
-
SSDEEP
768:C7rdsKADtOHiR4akrSQGXfFixrM+rMRa8Nutrt:C7rstVSWQGXfUi+gRJNC
Malware Config
Extracted
njrat
im523
Microsoft2
5.tcp.eu.ngrok.io:19057
2d747324ace3cb54ab462d02c1e6e943
-
reg_key
2d747324ace3cb54ab462d02c1e6e943
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
HEUR-Trojan.Win32.Generic-0efaae5b89cc78d6c04774d89aaea91010a7c4c8e614e83417446ad0ce89dc9e.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ