Behavioral task
behavioral1
Sample
D5189F9D42FA4F70F092D4EE353BF8DE6E5EB460A4C20.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
D5189F9D42FA4F70F092D4EE353BF8DE6E5EB460A4C20.exe
Resource
win10v2004-20221111-en
General
-
Target
D5189F9D42FA4F70F092D4EE353BF8DE6E5EB460A4C20.exe
-
Size
37KB
-
MD5
bf1371071b4e4b17a707360b7ec446b0
-
SHA1
9e3307b4e5c7584f393ad45d2b73799b344b4080
-
SHA256
d5189f9d42fa4f70f092d4ee353bf8de6e5eb460a4c20c0fdb89484d7eb19445
-
SHA512
782dede94a0ff940d357fd359dcdd5a03073b91b77c0faa8aa73626a81f818e67859522503e499d8644cedce8cfde3e46cbf0d0bd4c2701c89b50907ac1ed2ed
-
SSDEEP
384:nqqOHsiD7T95hL5YyUvhz/jO446wVjrAF+rMRTyN/0L+EcoinblneHQM3epzXuJ7:e3v5zUvhzLlwprM+rMRa8NuCyat
Malware Config
Extracted
njrat
im523
Читерок
4.tcp.ngrok.io:15925
9b078d556ba0d510848ea3853fd9ecb2
-
reg_key
9b078d556ba0d510848ea3853fd9ecb2
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
D5189F9D42FA4F70F092D4EE353BF8DE6E5EB460A4C20.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ