Behavioral task
behavioral1
Sample
bKoA.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bKoA.exe
Resource
win10v2004-20230220-en
General
-
Target
bKoA.exe
-
Size
32KB
-
MD5
91b1abb6601af6a0b7ef088543ddd6a9
-
SHA1
664c2d1c4acf07b94895ee46fe4cbbb7d31f9b94
-
SHA256
e05a921cb0193db227eab1d08459541252a91d603f4259aa75d0fd821fc6f25f
-
SHA512
12faaa830d48e03570843864e2880db652adb8661a8a45656c266b21bf72ad759339dbf16b011af7868c835ca7a5e1586efca5d59569e1b4dcac8e318f20b837
-
SSDEEP
384:v0bUe5XB4e0XUm+O5SlXCpF7r/oWTEtTUFQqzF/Obba:ET9BuUqMlQSVba
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
lavidaesbella202351.duckdns.org:5143
1946c05217594f6f8f6
-
reg_key
1946c05217594f6f8f6
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
bKoA.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ