384783f3d0a9b033fb1b63a97b096457
PE Executable | MD5: 384783f3d0a9b033fb1b63a97b096457 | Size: 56.32 KB | application/x-dosexec
Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 384783f3d0a9b033fb1b63a97b096457
|
| Sha1 | ca6a61c206ee33b1d742c58d3ab1151febbaa1b4
|
| Sha256 | 494b7ecc6fd2b79a141da8866f3250b5aee923bf499816ea2f901ef460e20bf9
|
| Sha384 | 4b5fa6df5766abad7874ce967f059a8bd8770d8917eddc3a2034c1730ee994498f935698191e0a42cf24b28da61b1e66
|
| Sha512 | bb7ae175337012de4aeeed3f7df9c990926e6de7bd43850614211247749138b2b4f60970ea0e832da089ad2704db1beabf8bc22873409b1527da7564dcc7b026
|
| SSDeep | 1536:FQCUbsDnyNho6JypySDxwsNMDMXExI3pmFm:WCEsDn4o6I4SDxwsNMDMXExI3pm
|
| TLSH | CD432744BFEA4A05E2BD8F3468F645150634BA63E632EB1E4CD668DB17327C58C40FE6
|
PeID
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | dllhost.exe |
| cnc_host [H] | yohlkdt3m.localto.net |
| is_dir_defined [Idr] | False |
| Anti_CH | False |
| is_startup_folder [IsF] | False |
| USB_SP | False |
| is_user_reg [Isu] | False |
| cnc_port [P] | 6258 |
| reg_key [RG] | c74ec7c7adce1fa9fb129a8d4b807594 |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| victim_name [VN] | Nigga |
| version [VR] | <- NjRAT 0.7d Horror Edition -> |
| splitter [Y] | Y262SUCZ4UJJ |
| MSGE | Disabled |
| MSGT | Themida |
| MSGB | Sorry, this application cannot run under a Virtual Machine |
| MSGSYM | vbCritical |
| OBITO | Disabled |
| TSKE | Disabled |
| TSK | Wireshark.exe |
| KAKASHI | Disabled |
| AKATSUKI | Disabled |
| CLEANSWEEP | Disabled |
| PASTEE | Disabled |
| PASTEBIN | https://pastebin.com/raw/??? |
| CLIP | null |
| UAC | Disabled |
| nowifi | off |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | call System.Void j.OK::ko() ret <null> |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | call System.Void j.OK::ko() ret <null> |
|
Name0 | Value |
|---|---|
| CnC | yohlkdt3m.localto.net |
| Port | 6258 |
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | dllhost.exe |
| cnc_host [H] | yohlkdt3m.localto.net |
| is_dir_defined [Idr] | False |
| Anti_CH | False |
| is_startup_folder [IsF] | False |
| USB_SP | False |
| is_user_reg [Isu] | False |
| cnc_port [P] | 6258 |
| reg_key [RG] | c74ec7c7adce1fa9fb129a8d4b807594 |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| victim_name [VN] | Nigga |
| version [VR] | <- NjRAT 0.7d Horror Edition -> |
| splitter [Y] | Y262SUCZ4UJJ |
| MSGE | Disabled |
| MSGT | Themida |
| MSGB | Sorry, this application cannot run under a Virtual Machine |
| MSGSYM | vbCritical |
| OBITO | Disabled |
| TSKE | Disabled |
| TSK | Wireshark.exe |
| KAKASHI | Disabled |
| AKATSUKI | Disabled |
| CLEANSWEEP | Disabled |
| PASTEE | Disabled |
| PASTEBIN | https://pastebin.com/raw/??? |
| CLIP | null |
| UAC | Disabled |
| nowifi | off |
|
Name0 | Value | Location |
|---|---|---|
| CnC | yohlkdt3m.localto.net Malicious |
384783f3d0a9b033fb1b63a97b096457 |
| Port | 6258 Malicious |
384783f3d0a9b033fb1b63a97b096457 |