Behavioral task
behavioral1
Sample
3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43_JC.exe
-
Size
32KB
-
MD5
e782fef1056c8725e60e298742004176
-
SHA1
4dadd7a9364d8a33751005c78d816871512f3056
-
SHA256
3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43
-
SHA512
13aa6a78b9052011467bc0c7322fe2ca6ffc1e090f4dd922179f36a29d767a4b1ecf18579b01d7e0961ac9cae783d82076af15015ab9ccdb5e70f0a0760f7bd3
-
SSDEEP
384:w0bUe5XB4e0X0gONaiaXLilpknD+WTCtTUFQqz9TObb4:1T9BuizaXWlRpb4
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
patria.duckdns.org:2020
8930d85a9f
-
reg_key
8930d85a9f
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43_JC.exe
Files
-
3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43_JC.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ