Behavioral task
behavioral1
Sample
5971ba49b4c2d43bc997cf365e65bf4f.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
5971ba49b4c2d43bc997cf365e65bf4f.exe
Resource
win10v2004-20231215-en
General
-
Target
5971ba49b4c2d43bc997cf365e65bf4f
-
Size
54KB
-
MD5
5971ba49b4c2d43bc997cf365e65bf4f
-
SHA1
358c725bb0988022c533f77ee975e39ae516c89d
-
SHA256
702bca106d99148d62af14389cfb74a89a536ff6ced032972720ae232f2393ba
-
SHA512
165011223b363766d4e93b2a78da5b915544469e86e1db3ac5247b540e01eb02d81c7bc77de5888bf779d8c26529f3d4b6bd79f54795451cb92bd149d265269a
-
SSDEEP
768:kW220U0Yl7A/vMHTi9bD6htHnYkFru0w9XXYeA3ebCEvDBkdyIjUle6+Lmmmmmmf:m20ULknYi9bMY2K0w5X8u95Ija
Malware Config
Extracted
njrat
v2.0
HacKed
negah-25309.portmap.io:5552
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5971ba49b4c2d43bc997cf365e65bf4f
Files
-
5971ba49b4c2d43bc997cf365e65bf4f.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ