Behavioral task
behavioral1
Sample
NEAS.3e0d2fc33eec557b11a3dcafb140a210.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.3e0d2fc33eec557b11a3dcafb140a210.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.3e0d2fc33eec557b11a3dcafb140a210.exe
-
Size
48KB
-
MD5
3e0d2fc33eec557b11a3dcafb140a210
-
SHA1
b1b835019b11ea056bcac391c13149450eca9a8e
-
SHA256
77d9f1777c74e6dcac13eec6653b090042175a64aea096595726f550e66d8ca3
-
SHA512
014f5deb53a1afeba6319909fcd9ebd225de312efce5d1bed0855c9674f25f61d270f22efa882bea41fcf0def02dc3788196aa886bece7da306dbe0ff701b8fe
-
SSDEEP
384:LcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZv6:Q30py6vhxaRpcnu5
Malware Config
Extracted
njrat
0.7d
New
web3.hopto.org:505
d84452416d06e8b0deb1e9407de41ba9
-
reg_key
d84452416d06e8b0deb1e9407de41ba9
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3e0d2fc33eec557b11a3dcafb140a210.exe
Files
-
NEAS.3e0d2fc33eec557b11a3dcafb140a210.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ