Behavioral task
behavioral1
Sample
bPNz.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bPNz.exe
Resource
win10v2004-20230915-en
General
-
Target
bPNz.exe
-
Size
32KB
-
MD5
df99e753c2a7ee4f8945b47116ce6a8b
-
SHA1
1a70c169fad4226c250b4f11e027affc5af03e63
-
SHA256
eff6aaeb772d0315098c03cd75f0efe84275499d604889e5888547116b8ff7c9
-
SHA512
a093f85195eeb0254d9306d8426a8972612dad741e5d0ca9fb9f479a3d535f4c9fe369f5260571030c565b5b9e842325781d493778b0fa2aeb508b41009605e7
-
SSDEEP
384:X0bUe5XB4e0X6ObaSjgkMRWTPtTUFQqz9tFObbn:8T9BuJ+Sjeqdbn
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
20.197.224.91:1098
c7e5e74aae5544af
-
reg_key
c7e5e74aae5544af
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bPNz.exe
Files
-
bPNz.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ