General
-
Target
sas.exe
-
Size
79KB
-
MD5
182686e01fc0a32d00b2ce80c327b130
-
SHA1
7524e797957bae4bd94679652569249cb83667ef
-
SHA256
69f269751b60b8503b524a67d6a24a9b55b50f243dee8e0fbe7ae0b09b5414ce
-
SHA512
e2a1c19621e9b5895f0a82af48e90378569e49691e938c3a3263cd527a403dcc7ff2875d49aeb9752ff685d866aa7f68e086adfa66abba7b690e12a852200841
-
SSDEEP
1536:wpWLCDnNENsG5uzH9SG7QOQ9i8WgcH4AikGkk45aIXExI3pmDx2I3:/LCDnmuzH9SG7VwnWNXExI3pmh
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Client
oxy01.duckdns.org:6522
e06cff8e57f0463e6228dbc0cf66c97e
-
reg_key
e06cff8e57f0463e6228dbc0cf66c97e
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
Files
-
sas.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 575B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ