Behavioral task
behavioral1
Sample
Clientexe_JC.exe
Resource
win7-20230831-en
General
-
Target
Clientexe_JC.exe
-
Size
32KB
-
MD5
826e3b59a507f80dcc7ab4b4215fea75
-
SHA1
4328328900a12f8e7d929962e513497edb39c0c5
-
SHA256
9659a74c9c448033f1945780405ebe60ee9854a07270272763de58c2a00105a0
-
SHA512
8a99ddb432ad6a4e2b00374907a6f5b7a155c37b109d8e01be784d36f4bdbbb6c7acf8b571c6356b25a298b139b665eca8092282f28e18fa44b7391ba13738ab
-
SSDEEP
768:KvhOBb13hdwzxLy3gcEOvVMRvqfQmIDUu0tiO2jT:YUZ6WZ6AQVkEjT
Malware Config
Extracted
njrat
0.7d
chr
127.0.0.1:6522
5a283f0ab1fa7ed5f23cb188a377b017
-
reg_key
5a283f0ab1fa7ed5f23cb188a377b017
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Clientexe_JC.exe
Files
-
Clientexe_JC.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ