Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20230703-en
General
-
Target
Server.exe
-
Size
37KB
-
MD5
e5befd0a2eed4060ac15edfba0c98f14
-
SHA1
340ed1def8ebf2377b6569468cbf6c37f3cdab05
-
SHA256
bf335c1b8b8aa937eb52d38964effe9ed4043bc20f8afcaec73ea3c68a81e822
-
SHA512
aec6529d43429fd702b4dadb78304060d914458e8a50b194321bde5fbdbbc75aaadc8698160ba663b4544593628200fd25f9628cff574b518e92798cd206a90c
-
SSDEEP
384:uAKnByEitvPJWtckUy8fuOmH1Ge9Pe8fKrAF+rMRTyN/0L+EcoinblneHQM3epzN:zKIzkX8fuOmUYeIKrM+rMRa8Nuv1t
Malware Config
Extracted
njrat
im523
HacKed
10.8.0.2:6882
90650fd6f1d029a20fa1a6ad123800b2
-
reg_key
90650fd6f1d029a20fa1a6ad123800b2
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Server.exe
Files
-
Server.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ