Behavioral task
behavioral1
Sample
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe
Resource
win10v2004-20230220-en
General
-
Target
540c26994ac206f56ced1ab9097edd71.bin
-
Size
11KB
-
MD5
dace19981162d1bb51679f45c2e3bae9
-
SHA1
ff4efcc5b150ed4ea60ada4eeda2513cc00ea70f
-
SHA256
5da576eef71856a926caecf0091f4468e60509d03eb162b8a96e9550f55a597c
-
SHA512
1a10544fd681ceff666f5958bb088742ae450bf72632ffcbc5374a70ad377d954c3b21c787337506efa741e12559de10a7def54c49e1e5d9be784a9ba90e1790
-
SSDEEP
192:XChBqn41G7SK+t7mSaxgCfsb1ZsRgknPcJq8fpn6tkoBAGWC78N3zCqMNAR5Xk8R:yTF1kSKc745yjs6+koS7ZBoG
Malware Config
Extracted
njrat
0.7d
HacKed
cisco5319.ddns.net:1177
22d454c9d4a86e192f7a5423970a5c83
-
reg_key
22d454c9d4a86e192f7a5423970a5c83
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
540c26994ac206f56ced1ab9097edd71.bin.zip
Password: infected
-
3d12a39e3a94131fc5cb7d5ad0a3ae94c94ed9f528a68bcdbc50f1316860e157.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ