Behavioral task
behavioral1
Sample
xZJKmUXowvtp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
xZJKmUXowvtp.exe
Resource
win10v2004-20230703-en
General
-
Target
xZJKmUXowvtp.exe
-
Size
32KB
-
MD5
577ecc8ea50f5633d57902d4d4f1b925
-
SHA1
88eb87e9985342c9117d3945bf771d2cb9ab8575
-
SHA256
784e7f352ce8a8ca2e2909967bb42e67652e964c981640222ba11aaa148f092d
-
SHA512
339d4c31eabd9bb71ad593b9b2d40ab60f5e6fbc4f0d5f861c6e806191d10ada57a4ddf34a0e395ac1d6ee414507392e7c5cee686ce452f369435ace9e0afff0
-
SSDEEP
384:k0bUe5XB4e0XmOnpQq1pvmufCsIsBWTFtTUFQqz9sObb9:hT9Bu1pQqvvmu6FGb9
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
fortuna777.duckdns.org:1994
5dc78800bc6b4
-
reg_key
5dc78800bc6b4
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xZJKmUXowvtp.exe
Files
-
xZJKmUXowvtp.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ