Behavioral task
behavioral1
Sample
2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a.exe
Resource
win10v2004-20230220-en
General
-
Target
f5d230103912e9b6015bf917e5831375.bin
-
Size
16KB
-
MD5
1badf2d699c20deb021ec83de7a32912
-
SHA1
ba7acd430f3d3a87a0bfe5f83a408a467f756e25
-
SHA256
c3e872b2491a055e93ca3b059d87991f60f02c45fc3b3100d355bdd05c1ca443
-
SHA512
004ddc782a681225ec417b8fc779ac29ebd0d4c52f099c0feea7ac4193d6e82b9a7128046b498c2cc6c7b6113a21964fb7687566229c7b7d24177da684941687
-
SSDEEP
384:O2aItdOBQb5kUY9p4I8uvDpuoF3WKIKiSq8EcWO344eIsRWdC:Ov6H5Sj8uZ3kg/xWOhCWdC
Malware Config
Extracted
njrat
im523
HacKed
212.187.4.161:3232
6bf55e0177bd5d9e7a5d6196e0752083
-
reg_key
6bf55e0177bd5d9e7a5d6196e0752083
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
f5d230103912e9b6015bf917e5831375.bin.zip
Password: infected
-
2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ