Behavioral task
behavioral1
Sample
6c16c29393e52ccda35c043aea1b1940.exe
Resource
win7-20230220-en
General
-
Target
6c16c29393e52ccda35c043aea1b1940.exe
-
Size
37KB
-
MD5
6c16c29393e52ccda35c043aea1b1940
-
SHA1
f440a53a8e1949aa361a311721b88efb7122e56a
-
SHA256
4445051491aed9c868c6641f7b2ff844047b5e61414bbc6e440ef2d7202348a5
-
SHA512
90d54c328c8443dcbba6be755578bd8c62fbb633000aafdba9d305e1b42a0e7b7bea8dfff978044c8712855ed72d71325f105ec1999c7a622e8d3bf6f7532f44
-
SSDEEP
384:1SSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXO:sS7TZ38fvCv3E1c1rM+rMRa8Nuvct
Malware Config
Extracted
njrat
im523
HacKed
0.tcp.sa.ngrok.io:19784
d129900b08bb5de7ee3568103142da72
-
reg_key
d129900b08bb5de7ee3568103142da72
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
6c16c29393e52ccda35c043aea1b1940.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ