Malicious
Malicious

8050adce83e6480a553e20a7d22da013

PE Executable
|
MD5: 8050adce83e6480a553e20a7d22da013
|
Size: 44.03 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
8050adce83e6480a553e20a7d22da013
Sha1
e320e296504d5e58ad69170dec248f6712b2208e
Sha256
55322e4e839b9d011b1bcbd974999424c1d8e1634413f816d789b34a2bc04b8b
Sha384
dda438cfb04f8fd150f0d25335fe3c3770a789c318e4de00e82e5778766a6936797b847fba647e623f469b37d1273e8f
Sha512
fcae2680fa8a60bf2683b14e8e253cfccbeccae1784d4b962657684c61f6551baaf6a9c7e0e0a605f2d6d1314cf84a4f1edbdd2a2a2035a90b7ad03899e03ccb
SSDeep
384:KZycwNU1SoycwJmzFZWhYY0oOgEHvLo8Glz0Iij+ZsNO3PlpJKkkjh/TzF7pWnL9:IQqglcwJcNPXToZuXQ/o++L
TLSH
9A13D78DB794E174D5FF8BF1A4A2B2890B71A017A802930FD9F154D94B73EC09611EE7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
8050adce83e6480a553e20a7d22da013
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

False
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

167.160.161.247
icn

#ic
is_dir_defined [Idr]

False
is_startup_folder [IsF]

True
RegistrySt

True
cnc_port [P]

8595
xDlol1

Nvidia Updater
Sleep

False
Sleep1

1
reg_key [RG]

svchost
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

Rǫ
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Artefacts
Name
 Value
CnC

167.160.161.247
Port

8595
8050adce83e6480a553e20a7d22da013 (44.03 KB)
File Structure
8050adce83e6480a553e20a7d22da013
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Characteristics
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

False
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

167.160.161.247
icn

#ic
is_dir_defined [Idr]

False
is_startup_folder [IsF]

True
RegistrySt

True
cnc_port [P]

8595
xDlol1

Nvidia Updater
Sleep

False
Sleep1

1
reg_key [RG]

svchost
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

Rǫ
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Artefacts
Name
 Value Location
CnC

167.160.161.247

Malicious

8050adce83e6480a553e20a7d22da013
Port

8595

Malicious

8050adce83e6480a553e20a7d22da013
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙