2f61cb4b14e0cf839a4a823eceea88e9

PE Executable

MD5: 2f61cb4b14e0cf839a4a823eceea88e9

Size: 37.89 KB

application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	2f61cb4b14e0cf839a4a823eceea88e9
Sha1	5bc1696dec9c0d82be4ff8910a7ae7c217e9e40e
Sha256	1086e2ec8e9274e1639f14084f27d3b47e606c37ccc2a1e4976db6633ef797d5
Sha384	f8fc43fc4d92b343aae24d02256a20ef3f780714494e27bc3b85e57c8126a76ad064f0fa33ea6efc4875c332b59bea1c
Sha512	ec941f09701d4b590777637262a1ea78e816b5121fae483848ad16a8e88460a1399da700f024c81aa0bcf8eb6608d66505bba47047ec63adf0e99268002d1534
SSDeep	384:VaDvkit2Zf5W9cTYXyc/lPM20zHFmnPuskrAF+rMRTyN/0L+EcoinblneHQM3ep4:kDqjjTYic/lkEPuprM+rMRa8NuSRt
TLSH	CA032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - njRAT config.

Config. Field0	Value
packet_size [b]	5121
BD [BD]	False
directory [DR]	TEMP
executable_name [EXE]	server.exe
cnc_host [HH]	155.117.183.181
is_dir_defined [Idr]	False
is_startup_folder [IsF]	False
is_user_reg [Isu]	False
NH [NH]	0
cnc_port [P]	2017
reg_key [RG]	7f17b610b84646a812ffba5fa871e451
reg_path [sf]	Software\Microsoft\Windows\CurrentVersion\Run
sizk	20
victim_name [VN]	HacKed
version [VR]	im523
splitter [Y]	\|'\|'\|
HD	False
anti [anti]	Exsample.exe
anti2 [anti2]	False
usb [usb]	False
usbx [usbx]	svchost.exe
task [task]	False

Informations

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>

Artefacts

Name	Value
Port	2017

2f61cb4b14e0cf839a4a823eceea88e9 (37.89 KB)