Behavioral task
behavioral1
Sample
d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7.exe
Resource
win10v2004-20230220-en
General
-
Target
d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7.zip
-
Size
25KB
-
MD5
9cc3ff24ca1ba5cfe2373b1a85f55738
-
SHA1
d7b66f71aec0d7b27791a962246b359dcf33081b
-
SHA256
40c83a8bd7e3181e5db639cad1aebd259473852be3b35c87e8db9412428e0b3a
-
SHA512
9405369e282c075c3f85692f089d33de75d301a194453df751fbf45b8e77ab464ec14a1b7abed7a41f695789e56ee8078fc154fe6df464c4395d6927116ed9c8
-
SSDEEP
768:ZSEBF/v7uhe2XKJngmnUJ7+qC+fLHmFlzNPYPuTgGe:ZxB9zuLXKJnKCcONwPuUGe
Malware Config
Extracted
njrat
Crypters
NYAN CAT
0.tcp.sa.ngrok.io:12257
00363c7d18814191
-
reg_key
00363c7d18814191
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7.zip.zip
Password: infected
-
d11cc7508d420994e19a1df2327d313303117948b62d386b00d8120e17666be7.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ