Behavioral task
behavioral1
Sample
2040-62-0x0000000000400000-0x0000000000414000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2040-62-0x0000000000400000-0x0000000000414000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2040-62-0x0000000000400000-0x0000000000414000-memory.dmp
-
Size
80KB
-
MD5
01308ba5ee84577f00401a343b346f08
-
SHA1
a0e853e535ac2fe7cacd30cd370d088385906e50
-
SHA256
0d3c8e57b2ca0439345b34be4d02b47785bbaecf0a2dd1ca43f6033faff8536c
-
SHA512
271a4ab0335d1dbf62a7eeabde58ff4512b46ee0dfde87c306c416ee4e62a30034dc7c0bdda6dd6463a96955663ec7436322584d60b7a784fe2bd123e377855d
-
SSDEEP
768:Q8DyFut1MankI2N9himQR3Q0kSNAmwFvfu0YMDHPsMI7XJSxI3pmdm:Q8y8Dn2N9himKdDVwsNMDOXExI3pmdm
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
oxy01.duckdns.org:6522
9d5ce28ee0015092fdcbbede58e23910
-
reg_key
9d5ce28ee0015092fdcbbede58e23910
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
Files
-
2040-62-0x0000000000400000-0x0000000000414000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ