Malicious
Malicious

a3247e6b32e3b8828c6548c88e3e3c92

PE Executable
|
MD5: a3247e6b32e3b8828c6548c88e3e3c92
|
Size: 44.03 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
a3247e6b32e3b8828c6548c88e3e3c92
Sha1
21501be17a3265c9badb95c61349b43e9b72db39
Sha256
7f930050a1cfb55393b738cef30ccfeeb540bb1d047ffecd0c2aaa038bf69c29
Sha384
c8f12aaf54b6dc04e5cb2d4fae22b686dfe115b9de7987c3785fa043c919d44bfd962e98d9f0e150fde99ae006f07295
Sha512
c82e397f4c6ea0b12b745f3712a27996ab9f20128d3d671df16ffc8084c88b8fc506e417461e3394bc5fab5f6db1cf9b9a264ac456f4c9ad76d6574f638e673a
SSDeep
384:YZyEvHn1iDcsyEqtBfkEGCOEhGyOEtzcIij+ZsNO3PlpJKkkjh/TzF7pWnj/greT:unHnU4pEqtNkE5SyZuXQ/oy3+L
TLSH
3813E78CB690E174D5FF8BF1B4A2B2890B71A01BA906D30F99F154D94B73EC09611EE7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
a3247e6b32e3b8828c6548c88e3e3c92
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

False
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

178.16.55.70
icn

#ic
is_dir_defined [Idr]

False
is_startup_folder [IsF]

True
RegistrySt

True
xDlol1

Java update
Sleep

False
Sleep1

1
reg_key [RG]

Windows Update
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Artefacts
Name
 Value
CnC

178.16.55.70
a3247e6b32e3b8828c6548c88e3e3c92 (44.03 KB)
File Structure
a3247e6b32e3b8828c6548c88e3e3c92
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Characteristics
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

False
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

178.16.55.70
icn

#ic
is_dir_defined [Idr]

False
is_startup_folder [IsF]

True
RegistrySt

True
xDlol1

Java update
Sleep

False
Sleep1

1
reg_key [RG]

Windows Update
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

True
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Artefacts
Name
 Value Location
CnC

178.16.55.70

Malicious

a3247e6b32e3b8828c6548c88e3e3c92
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙