Behavioral task
behavioral1
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2016-55-0x0000000000140000-0x0000000000152000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp
-
Size
72KB
-
MD5
d7c9553b35cd383d91b65291e228d75e
-
SHA1
bcb9606e2c4ba2ee2065ace2c9be99e162e3f17b
-
SHA256
aea8fca4704a2acab5b815530a77795c874c85bcf5562d07b649d0c99e8f8424
-
SHA512
a8a0fe5c85e5b75b709d98fb9499d9279f346a6f338ea81bdf53d3d7fc2641b4e0508332151ebceebf401f33da8a9ef0e19397142e943e18d2adb30c372fee33
-
SSDEEP
384:fZyoIYz/wpa9GP4Uy2vXy2m2EUSlhqzIIij+ZsNO3PlpJKkkjh/TzF7pWnb/greL:hnIKR4gh2vyV2SwuXQ/oCX+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
4.tcp.eu.ngrok.io:12433
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
Files
-
2016-55-0x0000000000140000-0x0000000000152000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
mscoree
_CorExeMain
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ