Behavioral task
behavioral1
Sample
bJ5I.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bJ5I.exe
Resource
win10v2004-20220812-en
General
-
Target
bJ5I.exe
-
Size
78KB
-
MD5
9fdb4688942194838315a9935f64182c
-
SHA1
b4a59f879418001b094653d7cad1b898a6f5eb59
-
SHA256
11ad2567eac856e69a0e013936830a52614caa6b3a1e2da4ca8ad08c995b72c0
-
SHA512
e147fcdd0e2556e31356386f05afa7bdefaf3db17bd505c458ff83cdbffe3d023eb0299d4d900eaf5a12e1bb805616da2ee52775f20f841014b91139c3941582
-
SSDEEP
1536:IkUM+seTFDpJS5wpOk3JCK6pFoFfr6fOpd/9nEh9TG6QqR:QQwpOk5CK6ZO/9ES6Qq
Malware Config
Extracted
njrat
0.7.3
mr2
cachi.duckdns.org:1981
RD.exe
-
reg_key
RD.exe
-
splitter
15173669
Signatures
-
Njrat family
Files
-
bJ5I.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ