Behavioral task
behavioral1
Sample
58da30c1f79e0d3450fdbc7683337fca0c404773019c37f5d27cadf0293c27d1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
58da30c1f79e0d3450fdbc7683337fca0c404773019c37f5d27cadf0293c27d1.exe
Resource
win10v2004-20220812-en
General
-
Target
96d246d7eb6019794f5b9f2a9c3fdb92.bin
-
Size
10KB
-
MD5
763dc246e64671260fcf87c2f44cd48f
-
SHA1
0ae2f7a51dc725f87d190bd084385c99529f4b98
-
SHA256
13ca6856f70433ca64dd4f806ea9c0a23695c1322efaec1b919485a63ff87ca1
-
SHA512
549b62323759c5ad422a2055ef5efc72df0eea433e3b0fe59f5764630db9717a953fb5d0af95b14af57ccac825e0eee9548c28e80d0c0962eaf0547f9daf3647
-
SSDEEP
192:V1OVwPb7CmfiodpwZyh1kr1/vnQYGVAk1wDNd6EJD/Kzk7LtfYU6y:TOCbblwZyhmrpPGKkGpd6EdFY6
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
carlitosmoreno1793.duckdns.org:2019
36f6099cb24
-
reg_key
36f6099cb24
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
96d246d7eb6019794f5b9f2a9c3fdb92.bin.zip
Password: infected
-
58da30c1f79e0d3450fdbc7683337fca0c404773019c37f5d27cadf0293c27d1.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ