Behavioral task
behavioral1
Sample
237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5.exe
Resource
win10v2004-20231023-en
General
-
Target
237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5
-
Size
91KB
-
MD5
647d98f9f09b97d8055a0e6d2f14e61b
-
SHA1
eb6fd80e12ca9305d78d4114903f7d9518aa0931
-
SHA256
237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5
-
SHA512
1d11095287a37b50c9a56d6e80371c6b873069c776a9cca8d3cca815adb3f95763e57f6669660dd2511755a0f357ddec1d1c0c472c067910c06e31e213b0c6a0
-
SSDEEP
768:MGZefAM+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzktFI3tr3/iTnRVOR1MY4WW:GfAl0pUjBjZdL4kHG5mktQJVR1DpEv
Malware Config
Extracted
njrat
hakim32.ddns.net:2000
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5
Files
-
237429aaecf58259c1bdab8273ac1762c3e2e0326641d2bbb90d958d41709cd5.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ