Behavioral task
behavioral1
Sample
D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe
Resource
win10v2004-20230703-en
General
-
Target
D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe
-
Size
37KB
-
MD5
9935e8052dcd7d3e60de0eabb8a9295c
-
SHA1
191f32f08f2f2c1c64822f40fecfd0726c5c023e
-
SHA256
d02e3399d85d6b14b30f440181ef5b8fe6b55c403b8c7ee908582530d4c67ef6
-
SHA512
ec464a6acc9b05b04095d533dd4669fd52e6bc460136ba41f0c5f74a1203c4128ddb8d495ca21c6e3f7185fa41c999ab5dddc42ab594c5d134495d4a5369ec7b
-
SSDEEP
384:90SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXe:iS7TZ38fvCv3E1c1rM+rMRa8NuSzt
Malware Config
Extracted
njrat
im523
HacKed
2.tcp.eu.ngrok.io:14368
3773325f82c0d53fdf099006eb71b3fd
-
reg_key
3773325f82c0d53fdf099006eb71b3fd
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe
Files
-
D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ