4b5298b008c468b18335896a378247e9
PE Executable | MD5: 4b5298b008c468b18335896a378247e9 | Size: 56.32 KB | application/x-dosexec
Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 4b5298b008c468b18335896a378247e9
|
| Sha1 | 32d7646d750064523879a5a62734aedd57a06743
|
| Sha256 | 632e99e9d581110ecf24bfa136e7f5af0df8fe6dcdd98f91dee11136e8011964
|
| Sha384 | 4b26fc5fa24d7ebe1c35ca52d60cca9d603beab201fe04d8e169b509c11d06b118ba2793cd2f356bf3f875dcc7b8e92c
|
| Sha512 | 4b28cb7b225a718a79443f9b58e56c2c4497807b72fe3c2f6b8683eeec88f411448b7d824aee70d9586cd107adc300e22a1ab1439ea2d5c6d21b54adfc6da96f
|
| SSDeep | 1536:QQCUbsDnyNho6JypySDqwsNMDfXExI3pmaOm:vCEsDn4o6I4SDqwsNMDfXExI3pm
|
| TLSH | 8A431740BFEA4A05E2BD8F3468F655150634BA63E632EB1E4CD668DB17327C58C40FE6
|
PeID
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | dllhost.exe |
| cnc_host [H] | yohlkdt3m.localto.net |
| is_dir_defined [Idr] | False |
| Anti_CH | False |
| is_startup_folder [IsF] | False |
| USB_SP | False |
| is_user_reg [Isu] | False |
| cnc_port [P] | 6677 |
| reg_key [RG] | 45eda18d441c7819839790de86984f4f |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| victim_name [VN] | Nigga |
| version [VR] | <- NjRAT 0.7d Horror Edition -> |
| splitter [Y] | Y262SUCZ4UJJ |
| MSGE | Disabled |
| MSGT | Themida |
| MSGB | Sorry, this application cannot run under a Virtual Machine |
| MSGSYM | vbCritical |
| OBITO | Disabled |
| TSKE | Disabled |
| TSK | Wireshark.exe |
| KAKASHI | Disabled |
| AKATSUKI | Disabled |
| CLEANSWEEP | Disabled |
| PASTEE | Disabled |
| PASTEBIN | https://pastebin.com/raw/??? |
| CLIP | null |
| UAC | Disabled |
| nowifi | off |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | call System.Void j.OK::ko() ret <null> |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | call System.Void j.OK::ko() ret <null> |
|
Name0 | Value |
|---|---|
| CnC | yohlkdt3m.localto.net |
| Port | 6677 |
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | dllhost.exe |
| cnc_host [H] | yohlkdt3m.localto.net |
| is_dir_defined [Idr] | False |
| Anti_CH | False |
| is_startup_folder [IsF] | False |
| USB_SP | False |
| is_user_reg [Isu] | False |
| cnc_port [P] | 6677 |
| reg_key [RG] | 45eda18d441c7819839790de86984f4f |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| victim_name [VN] | Nigga |
| version [VR] | <- NjRAT 0.7d Horror Edition -> |
| splitter [Y] | Y262SUCZ4UJJ |
| MSGE | Disabled |
| MSGT | Themida |
| MSGB | Sorry, this application cannot run under a Virtual Machine |
| MSGSYM | vbCritical |
| OBITO | Disabled |
| TSKE | Disabled |
| TSK | Wireshark.exe |
| KAKASHI | Disabled |
| AKATSUKI | Disabled |
| CLEANSWEEP | Disabled |
| PASTEE | Disabled |
| PASTEBIN | https://pastebin.com/raw/??? |
| CLIP | null |
| UAC | Disabled |
| nowifi | off |
|
Name0 | Value | Location |
|---|---|---|
| CnC | yohlkdt3m.localto.net Malicious |
4b5298b008c468b18335896a378247e9 |
| Port | 6677 Malicious |
4b5298b008c468b18335896a378247e9 |