Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 8050adce83e6480a553e20a7d22da013
|
| Sha1 | e320e296504d5e58ad69170dec248f6712b2208e
|
| Sha256 | 55322e4e839b9d011b1bcbd974999424c1d8e1634413f816d789b34a2bc04b8b
|
| Sha384 | dda438cfb04f8fd150f0d25335fe3c3770a789c318e4de00e82e5778766a6936797b847fba647e623f469b37d1273e8f
|
| Sha512 | fcae2680fa8a60bf2683b14e8e253cfccbeccae1784d4b962657684c61f6551baaf6a9c7e0e0a605f2d6d1314cf84a4f1edbdd2a2a2035a90b7ad03899e03ccb
|
| SSDeep | 384:KZycwNU1SoycwJmzFZWhYY0oOgEHvLo8Glz0Iij+ZsNO3PlpJKkkjh/TzF7pWnL9:IQqglcwJcNPXToZuXQ/o++L
|
| TLSH | 9A13D78DB794E174D5FF8BF1A4A2B2890B71A017A802930FD9F154D94B73EC09611EE7
|
PeID
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | Dllhost.exe |
| cnc_host [H] | 167.160.161.247 |
| icn | #ic |
| is_dir_defined [Idr] | False |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 8595 |
| xDlol1 | Nvidia Updater |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | svchost |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | True |
| HP | True |
| SPR | false |
| victim_name [VN] | Rǫ |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
|
Name0 | Value |
|---|---|
| CnC | 167.160.161.247 |
| Port | 8595 |
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | False |
| directory [DR] | TEMP |
| executable_name [EXE] | Dllhost.exe |
| cnc_host [H] | 167.160.161.247 |
| icn | #ic |
| is_dir_defined [Idr] | False |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 8595 |
| xDlol1 | Nvidia Updater |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | svchost |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | True |
| HP | True |
| SPR | false |
| victim_name [VN] | Rǫ |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value | Location |
|---|---|---|
| CnC | 167.160.161.247 Malicious |
8050adce83e6480a553e20a7d22da013 |
| Port | 8595 Malicious |
8050adce83e6480a553e20a7d22da013 |