Behavioral task
behavioral1
Sample
xyMxPOlHzrr7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
xyMxPOlHzrr7.exe
Resource
win10v2004-20230220-en
General
-
Target
xyMxPOlHzrr7.exe
-
Size
32KB
-
MD5
e3f8da8e9022a6e9e77d7accbab2fc9e
-
SHA1
5364ee7b5131f197bddc745cc2bacb48272c50a2
-
SHA256
4b54fe5466cde6d4b3082cd5809aa4741c5741ab3bf682c54dd6a07fba2241a6
-
SHA512
be5ca946c770def4169c27d507bf15b9f6bb4a39336cfc6b49222f8b1bd698467cd380fc52017936857ed061c2825a23d21b7e2d75605ca398ae5420b7efa5e6
-
SSDEEP
384:M0bUe5XB4e0XXOVFggUBZIGNWTFtTUFQqzF/ObbZ:ZT9BueDggUBZIpFbZ
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
rick63.publicvm.com:6857
4d93399b28e84
-
reg_key
4d93399b28e84
-
splitter
@!#&^%$
Signatures
-
Njrat family
Files
-
xyMxPOlHzrr7.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ