11c3196429a302348c62e6da8cfb886a

PE Executable
|
MD5: 11c3196429a302348c62e6da8cfb886a
|
Size: 37.89 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	11c3196429a302348c62e6da8cfb886a
Sha1	57e8df5da599483555e30633e3d403ddfc9f0089
Sha256	46a9fd7c1f057ddb96e35ae32b81273b7ef1c2abd0fd0b41a414cf6e657a77c9
Sha384	ccb3cfc19b08f995abdb055808331c93fa5c0a0f4289282b38474fc826414673579d2f61584de96d2d9ca75098fb2f5f
Sha512	8370195cd7d4b71049d4ccc627fe26fbd63f3a6187d81043c21e1b800014c06d496fc9c8446293376ccc437a232d5efa03863aeeba7ead54731ea6ef72df2281
SSDeep	384:SspMiL3BndznNCyMGmjuu3HJcWYbAUrAF+rMRTyN/0L+EcoinblneHQM3epzXnNZ:VpRNRMGmjbZdYPrM+rMRa8Nuxtt
TLSH	52033A4D7BE18168C5FD057B05B2D01207BBE04F2E23D90E8EE564AA37636C58B54EF1

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - njRAT config.

Config. Field0	Value
packet_size [b]	5121
BD [BD]	True
directory [DR]	AllUsersProfile
executable_name [EXE]	server.exe
cnc_host [HH]	92.60.78.221
is_dir_defined [Idr]	True
is_startup_folder [IsF]	False
is_user_reg [Isu]	True
NH [NH]	0
cnc_port [P]	443
reg_key [RG]	bba034f89771d77d1c181b1a973bd390
reg_path [sf]	Software\Microsoft\Windows\CurrentVersion\Run
sizk	100
victim_name [VN]	HacKed
version [VR]	im523
splitter [Y]	\|'\|'\|
HD	True
anti [anti]	Exsample.exe
anti2 [anti2]	False
usb [usb]	True
usbx [usbx]	svchost.exe
task [task]	True

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>

Artefacts

Name0	Value
Port	443

11c3196429a302348c62e6da8cfb886a (37.89 KB)