Behavioral task
behavioral1
Sample
856-60-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
856-60-0x0000000000400000-0x000000000040C000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
856-60-0x0000000000400000-0x000000000040C000-memory.dmp
-
Size
48KB
-
MD5
b69a4478bd466e31959dfa878f79286d
-
SHA1
918062d41b16412e166f566d0036c27c85043222
-
SHA256
356c52be83d711055a92d996b9895864c1eeb5bd8dc1c7a37fe0f4032090dd57
-
SHA512
a8a23e659a3987e7570c132cd684e485d2c35108136ca08651fbffb54b200a7ce2684d1899d61b51c4631712037138ea37b3aa5537513deb49a830e8db36176d
-
SSDEEP
384:U0bUe5XB4e0XfOVFggUBZIGWWTWtTUFQqzFJ9Obb:xT9Bu2DggUBZIzkSb
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
capurgana.duckdns.org:2054
d05dc46f6b3
-
reg_key
d05dc46f6b3
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
856-60-0x0000000000400000-0x000000000040C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ