d6902a0202524af2b0cfe3a04dcb4d6a

PE Executable
|
MD5: d6902a0202524af2b0cfe3a04dcb4d6a
|
Size: 37.89 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	d6902a0202524af2b0cfe3a04dcb4d6a
Sha1	278b13e9d0387b2359b10247d903a6bd8b62bde8
Sha256	1d44d9e83cbb1656ba5a8afa3fa00ba849ff5a43eb6f49f519d4b67bc64b0c40
Sha384	24e31ca52b999382c9f7b513d9a5eec05df7211829186e7511f02362379b5edd9207b08ba42dda68dec04620c2b9b902
Sha512	904b14461442ea8373714b85fc207576a4042b19e3d6a139c0c74851a412a0ad1923ac305026940b2f57537a4461c2098d5f9ad0cfb41ff90a716f77b47d719b
SSDeep	384:14SKMizdLjnBhFbJ8ycP3hXZVwaihMrAF+rMRTyN/0L+EcoinblneHQM3epzXwNS:uSgLlLJfcP3h/NiOrM+rMRa8NuyMt
TLSH	3E032B4D7FE18168C5FE457B06B2D41207BAE04B6E23D90E8EF564AA37635C18F50AF2

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - njRAT config.

Config. Field0	Value
packet_size [b]	5121
BD [BD]	False
directory [DR]	TEMP
executable_name [EXE]	server.exe
cnc_host [HH]	four-railway.gl.at.ply.gg
is_dir_defined [Idr]	False
is_startup_folder [IsF]	False
is_user_reg [Isu]	False
NH [NH]	0
cnc_port [P]	22872
reg_key [RG]	46218474f044dbd27225cc6382b9b7ee
reg_path [sf]	Software\Microsoft\Windows\CurrentVersion\Run
sizk	512
victim_name [VN]	HacKed
version [VR]	im523
splitter [Y]	\|'\|'\|
HD	False
anti [anti]	Exsample.exe
anti2 [anti2]	False
usb [usb]	False
usbx [usbx]	svchost.exe
task [task]	False

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>

Artefacts

Name0	Value
Port	22872

d6902a0202524af2b0cfe3a04dcb4d6a (37.89 KB)