Behavioral task
behavioral1
Sample
1db6a70072f4c490f3c2ae7c38c96773.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1db6a70072f4c490f3c2ae7c38c96773.exe
Resource
win10v2004-20230915-en
General
-
Target
1db6a70072f4c490f3c2ae7c38c96773.bin
-
Size
31KB
-
MD5
1db6a70072f4c490f3c2ae7c38c96773
-
SHA1
9acfde1c2ce576006f9cc39f4ab24b7fd594eea4
-
SHA256
fac04032b52e20f4a11d20869d03d86bc720351c59ae181416414d89ca4c41a9
-
SHA512
ff45d3517d9a13072a05d5cbfec8d81ea7e5f8f88ce2d4f79b7d58941c666320c4b4d3880720fb7418a63ed67948028207438b76d6b099e2833362e085ffe3e3
-
SSDEEP
384:Z4LgP+rjEb+AUbJr2bEtIgZQPK2m0M5AQk93vmhm7UMKmIEecKdbXTzm9bVhcauZ:URFGiJ5A/vMHTi9bDHyhgYQ
Malware Config
Extracted
njrat
v2.0
HacKed
graphics-calculation.gl.at.ply.gg:47426
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1db6a70072f4c490f3c2ae7c38c96773.bin
Files
-
1db6a70072f4c490f3c2ae7c38c96773.bin.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ