Behavioral task
behavioral1
Sample
xRQ5JIRKM9GT.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
xRQ5JIRKM9GT.exe
Resource
win10v2004-20230220-en
General
-
Target
xRQ5JIRKM9GT.exe
-
Size
32KB
-
MD5
1b256f9f42a53e70d8ed63804dcc1fb9
-
SHA1
c3ab0958c1dc8e82cd7fcba3ddbfd6d9ba72d7d4
-
SHA256
9fc2348f118f300d0d142c58dbf0f3317e2934bac68267e7c7487ffa1eda1f35
-
SHA512
2a98dc4623683ef88f6483a90dd4d72e27256accc37b0837620bd96c9a9b88edd9f3dcfefd0e7c09400b0ba237cc8556022d7a6c6795c6b8adc3dfbdf8a2da3b
-
SSDEEP
384:+0bUe5XB4e0XrODxggUBZIGFWT5tTUFQqzF1IObbT:vT9BuS9ggUBZIpAvbT
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
crazydns.linkpc.net:5900
d9590f01b48c43
-
reg_key
d9590f01b48c43
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
xRQ5JIRKM9GT.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ