Behavioral task
behavioral1
Sample
149069598db31db305dbd822b156e249.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
149069598db31db305dbd822b156e249.exe
Resource
win10v2004-20231130-en
General
-
Target
149069598db31db305dbd822b156e249.exe
-
Size
36KB
-
MD5
149069598db31db305dbd822b156e249
-
SHA1
853df6ed8db672664f7c4e5911cf73c8330c9c04
-
SHA256
5869f74791cb84c168e2d6ece00b536880a29db0b59ef963d5a543ab3e2bb89d
-
SHA512
61c17297406706196297707b55412eddc3ecdd7c2fdfc424a37262a114a75f4d1fb1bf99e5b03be0f1bc12dd941b0f97e69846cc0b8a648059b7e05e8987bfbb
-
SSDEEP
384:dxqCKMizd3jnBhFbJ8ycPj93tRwympVrAF+rMRTyN/0L+EcoinblneHQM3epzXhr:dECg3lLJfcPj9XNm7rM+rMRa8NuX5t
Malware Config
Extracted
njrat
im523
HacKed
2.tcp.eu.ngrok.io:16458
af78e772b16b220a2184770c875037cc
-
reg_key
af78e772b16b220a2184770c875037cc
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 149069598db31db305dbd822b156e249.exe
Files
-
149069598db31db305dbd822b156e249.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ