Behavioral task
behavioral1
Sample
836-55-0x0000000000290000-0x000000000029C000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
836-55-0x0000000000290000-0x000000000029C000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
836-55-0x0000000000290000-0x000000000029C000-memory.dmp
-
Size
48KB
-
MD5
5c63f2d044398ca724e6c3d3ff5b69e6
-
SHA1
e2bbf95a4de5382c8496225e9847e73451f015fe
-
SHA256
8b3b08a56bd41c53c1d93ab447354e58cc15a9aabf4520e7f23e3375481b4e84
-
SHA512
2823147737ad106dae2abc7454b00d2f207a35d1019b997ede9bc68784bc507b2eec5cc440bdcc83c0aa68443e69e73cd018042ece77241fedcbe6a0a139e6ca
-
SSDEEP
384:s0bUe5XB4e0XmO3wc6WQzwWTntTUFQqz9qAObb3:5T9Bu1AcrQxJb3
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
seznam.zapto.org:5050
6cb5de0e268
-
reg_key
6cb5de0e268
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
836-55-0x0000000000290000-0x000000000029C000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ