Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 1628f80b4a10bceb9eef5b896efefe13
|
| Sha1 | ea2a1ad3f2759a415d092bc0ea32a629c25e8a24
|
| Sha256 | a3ce46df9a17c112b1b9b777a77fdad0ca1a0b3eb48c7f01d0ec32e71514af1c
|
| Sha384 | da5c7f8b7003113f1fbab4a3a84055849fb25a516203ae65c7598d22c7c6e8afa99b239e704a808258c1c860f7727160
|
| Sha512 | ad5987060c3ac2009a4c0af256c24be81df6b9b1a52a40c3576f7f204747c811cca0ae30b68164b7547cb2c308c57f1295fc02c412c7ae8b51f5f00daf852917
|
| SSDeep | 384:+ZyQCFIB+oyiFN7cWMEHavIuZzQIij+ZsNO3PlpJKkkjh/TzF7pWnXugreT0pqf7:Ei+Ilir7zOHuXQ/oKa+L
|
| TLSH | 7A13C68CB694E174D5FF8BF1F4A2B2890B71A027A806930F99F154D94B73EC09611EE7
|
PeID
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | True |
| directory [DR] | WinDir |
| executable_name [EXE] | svchost.exe |
| cnc_host [H] | 147.185.221.31 |
| icn | #ic |
| is_dir_defined [Idr] | True |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 2232 |
| xDlol1 | Java update |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | Windows Update |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | True |
| HP | True |
| SPR | false |
| victim_name [VN] | System |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
|
Name0 | Value |
|---|---|
| CnC | 147.185.221.31 |
| Port | 2232 |
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | True |
| directory [DR] | WinDir |
| executable_name [EXE] | svchost.exe |
| cnc_host [H] | 147.185.221.31 |
| icn | #ic |
| is_dir_defined [Idr] | True |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 2232 |
| xDlol1 | Java update |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | Windows Update |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | True |
| HP | True |
| SPR | false |
| victim_name [VN] | System |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value | Location |
|---|---|---|
| CnC | 147.185.221.31 Malicious |
1628f80b4a10bceb9eef5b896efefe13 |
| Port | 2232 Malicious |
1628f80b4a10bceb9eef5b896efefe13 |