Malicious
Malicious

2fd4159228215be82a2e12dc2a21a4f7

PE Executable
|
MD5: 2fd4159228215be82a2e12dc2a21a4f7
|
Size: 44.03 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
2fd4159228215be82a2e12dc2a21a4f7
Sha1
e913ffb00fe22a1e2dfe650f5862edea89dc8479
Sha256
6d1aa6768394decd5f24bcabbc3ab3bf08f140fad1e11100240b471cc2a5aaf8
Sha384
fa667139ca58aa8921d0a0d82de9d61e47ae8355f3d9484bf29a12836d3b8b9771c0faa2452cd6cacc6dcb9c9de1666a
Sha512
7eaf1f07e2acad09f9a4478d1f4dff359d7a88805b36c009ab61326dccf9f0070c35aaa7d8f0d8614540c80f4c29301e4faae29b094cf4593cc1813e5e98ad65
SSDeep
384:TZyYO5clQ5GoyypblTI76M2EXnHrzIIij+ZsNO3PlpJKkkjh/TzF7pWnLYgreT0k:dhmolypbFILxNuXQ/ouM+L
TLSH
E513E84CB794E174D5FF8BF1B4A2B2890B71A01BA802930F99F154D94B73EC09A11EE7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
2fd4159228215be82a2e12dc2a21a4f7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

True
directory [DR]

UserProfile
executable_name [EXE]

Dllhost.exe
cnc_host [H]

126.65.224.254
icn

#ic
is_dir_defined [Idr]

True
is_startup_folder [IsF]

True
RegistrySt

True
xDlol1

google chrome.exe
Sleep

False
Sleep1

1
reg_key [RG]

explorer.exe
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Artefacts
Name
 Value
CnC

126.65.224.254
2fd4159228215be82a2e12dc2a21a4f7 (44.03 KB)
File Structure
2fd4159228215be82a2e12dc2a21a4f7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Characteristics
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

True
directory [DR]

UserProfile
executable_name [EXE]

Dllhost.exe
cnc_host [H]

126.65.224.254
icn

#ic
is_dir_defined [Idr]

True
is_startup_folder [IsF]

True
RegistrySt

True
xDlol1

google chrome.exe
Sleep

False
Sleep1

1
reg_key [RG]

explorer.exe
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Artefacts
Name
 Value Location
CnC

126.65.224.254

Malicious

2fd4159228215be82a2e12dc2a21a4f7
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙