Malicious
Malicious

ba7f355aef6f4e5eddbdc5905dac65e2

PE Executable
|
MD5: ba7f355aef6f4e5eddbdc5905dac65e2
|
Size: 44.03 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
ba7f355aef6f4e5eddbdc5905dac65e2
Sha1
dc9376b735fc0099ff764422fd04406446970cef
Sha256
a68c35f181697c3f82aa950a4720be636c9103f8532cefd9eb1e7735936c9deb
Sha384
8fd97a1d2d0265f311ca712e55737eaa7f105a1b8a5053313f2806b9312b68d7a08b9516c8246823d6522975acfac11a
Sha512
b8d0bbc515f36550ae5d6696ae7af5c05946d9b3088b85ceb373b60de3b2fead2c2f3ba8269d71d6bde6e46eade6773c8ad930da7afb5c32a11c9005bf5aecd6
SSDeep
384:9ZyuMg98NaIyrtdb32E68ExiE7azsIij+ZsNO3PlpJKkkjh/TzF7pWnI/greT0pO:3LywFrLb32HVAuXQ/ot/+L
TLSH
7713C68CB694E174D5FF8BF1A4A2B2890B71A017A902D30F99F154D94BB3EC09611EE7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
ba7f355aef6f4e5eddbdc5905dac65e2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

True
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

167.160.161.247
icn

#ic
is_dir_defined [Idr]

True
is_startup_folder [IsF]

True
RegistrySt

True
cnc_port [P]

8595
xDlol1

Java update
Sleep

False
Sleep1

1
reg_key [RG]

Windows Update
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

False
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Module Name

Stub.exe
Full Name

Stub.exe
EntryPoint

System.Void Stub.OK.j.A::main()
Scope Name

Stub.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

436
Main Method

System.Void Stub.OK.j.A::main()
Main IL Instruction Count

20
Main IL

ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null>
Artefacts
Name
 Value
CnC

167.160.161.247
Port

8595
ba7f355aef6f4e5eddbdc5905dac65e2 (44.03 KB)
File Structure
ba7f355aef6f4e5eddbdc5905dac65e2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Characteristics
Malware Configuration - njRAT config.
Config. Field
 Value
packet_size [b]

5121
BD [BD]

True
directory [DR]

TEMP
executable_name [EXE]

Dllhost.exe
cnc_host [H]

167.160.161.247
icn

#ic
is_dir_defined [Idr]

True
is_startup_folder [IsF]

True
RegistrySt

True
cnc_port [P]

8595
xDlol1

Java update
Sleep

False
Sleep1

1
reg_key [RG]

Windows Update
task [Task]

True
reg_path [sf]

Software\Microsoft\Windows\CurrentVersion\Run
Hide

False
HP

True
SPR

false
victim_name [VN]

HacKed
version [VR]

Njrat 0.7 Golden By Hassan Amiri
splitter [Y]

|Hassan|
Artefacts
Name
 Value Location
CnC

167.160.161.247

Malicious

ba7f355aef6f4e5eddbdc5905dac65e2
Port

8595

Malicious

ba7f355aef6f4e5eddbdc5905dac65e2
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙