Behavioral task
behavioral1
Sample
3507e1c0a846b0e399ed66a4e16113e2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3507e1c0a846b0e399ed66a4e16113e2.exe
Resource
win10v2004-20230703-en
General
-
Target
3507e1c0a846b0e399ed66a4e16113e2.exe
-
Size
3.4MB
-
MD5
3507e1c0a846b0e399ed66a4e16113e2
-
SHA1
2d3e1d3bb63150b41d8fa5ef455739f9f78bd3d5
-
SHA256
65ca589b0756f399638736bbed0bf7fefc438c482b62fe75b405f07d9be2234e
-
SHA512
9b39954495b23665988e96346085fe4f221d36c76aeda42f4ee45fa09a11e437c49b022f86a50bd09be68007a809b3c8fb6782c498898497ead42a3c1aeeb155
-
SSDEEP
49152:V5JEAOSHaNvPTKIO59eK4TSc5dd+qQvmH+mk79pD:VTEAOVluIseF2cp+5vqZk
Malware Config
Extracted
njrat
im523
HacKed
4.tcp.eu.ngrok.io:16689
beba7179c2c8b96895365cfaad2a5e85
-
reg_key
beba7179c2c8b96895365cfaad2a5e85
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3507e1c0a846b0e399ed66a4e16113e2.exe
Files
-
3507e1c0a846b0e399ed66a4e16113e2.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.food Size: 912KB - Virtual size: 912KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ