Behavioral task
behavioral1
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp
-
Size
72KB
-
MD5
d59dc04b89884bc9e9516868ca92553f
-
SHA1
6f9dea35eafb06a80526ed5dae6feffdd49b97a2
-
SHA256
8a10dc5d3f61e2b14443f4363510dfc9875902628f00f93a8189db27e3565b93
-
SHA512
0067092b9fab3e5e772d0799a7b90b491b9f961430f19ba9ea4dcd8a9274b70029d1509d773a8bc2e32dfa7d4034710aa512b388090249b4aa3b1f4647bcfe23
-
SSDEEP
384:JZyjdElQ5GoyyBrlr0DiEuEe83H/zIIij+ZsNO3PlpJKkkjh/TzF7pWnV/greT0c:LRmolyBr907NRuXQ/o4/+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
2.tcp.eu.ngrok.io:18666
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
Files
-
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
mscoree
_CorExeMain
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ