Behavioral task
behavioral1
Sample
2222222222222222222.exe
Resource
win7-20230220-en
General
-
Target
2222222222222222222.exe
-
Size
69KB
-
MD5
f2d4c74d4d1fc97fcc8cfe02ca2dd1eb
-
SHA1
8213a0fd44d330837631cd7df12235871cda4e34
-
SHA256
68bb309a02780e53b94f36eb0d9b1a03a69eede3b16deabbe0deb2ce83abe5bb
-
SHA512
0e523eb6cefbb1a73f223e7df9e01ca7f921a763a7d595482ab7b18414429a780b9f0a646aa7d30aed34225a65bca1cc1038c1caf45343870f3811e7cf3e96d8
-
SSDEEP
1536:/XKgWTpYH+C8tIiZtrBLTvAs2bvA3teOWTkuLPZ9b3mVcxug0ZdRaEX1iNyaF9b5:/XKgWTpYH+C8t5zlLT92bvcwkWR9b1ue
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:31440
win64.exe
-
reg_key
win64.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2222222222222222222.exe
Files
-
2222222222222222222.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ