Behavioral task
behavioral1
Sample
bKBx.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bKBx.exe
Resource
win10v2004-20230220-en
General
-
Target
bKBx.exe
-
Size
32KB
-
MD5
4c5c88969f4e671c80cc7fd337cbb969
-
SHA1
604bc24156ab1292b8f3f39def64b35e559e3e0d
-
SHA256
3a07daefd68fc95fa0ab44882ea966fb45969015e49914a5e3ca4abce43aff54
-
SHA512
335c3fc03ad76d9c0eca3a6c8996352d87945ebd57195b384ed8753529aead8a35c0939892e179290489da3c7ddd4609a896a3a7709b762f8064e9cdca401c67
-
SSDEEP
384:y0bUe5XB4e0XFOZzw0Q0mS03AWTxtTUFQqzFAObbV:rT9BucC55dWbV
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
0.tcp.sa.ngrok.io:15953
c8dfd06d27404c34
-
reg_key
c8dfd06d27404c34
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
bKBx.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ