Behavioral task
behavioral1
Sample
good.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
good.exe
Resource
win10v2004-20230221-en
General
-
Target
good.exe
-
Size
37KB
-
MD5
3728b1b10121c4549e3b3d19999ad4ec
-
SHA1
7ddddfa411bb123f3e5fec93e9af72971b47cbc9
-
SHA256
a37907a6aeac317a33c5f5978a5cc374415f328402d3d36b0fe53eb022b4dfc1
-
SHA512
3a0ac58d9639703e1cbdc4ece501549deb0061822e9adf6cdf364affe6830ef5189b4d00f7c936733981ebb1880b4c2d2525f6005165dec6aa3b696da28a6fba
-
SSDEEP
768:RJoDQmUbCv/cP1mzMvWZVrM+rMRa8NuKSt:R6DAbW0NOMOZO+gRJNR
Malware Config
Extracted
njrat
im523
HacKed
127.0.0.1:5553
009d27284742cf4b171605f27489cc13
-
reg_key
009d27284742cf4b171605f27489cc13
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
good.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ