Behavioral task
behavioral1
Sample
ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1.exe
Resource
win10v2004-20231215-en
General
-
Target
ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1
-
Size
37KB
-
MD5
1379dcf7afe3f270834a611a19403963
-
SHA1
a9c34f014fc32cc5480df9dc1d1cf56732d60d6d
-
SHA256
ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1
-
SHA512
2fa5c178b5e77647c2ffa5a11d12412f10bb45dac7a923ea3932b4dba7fd56a9c94e06f33a5f01636bc39abfeb7d9f287331af75dd6bd148c7e03355651e2859
-
SSDEEP
384:hYDQZCiT9SLhHGhlbJcycPxvQJIwX5iwaCBDrAF+rMRTyN/0L+EcoinblneHQM3j:uIDrJ/cPxoIw0NChrM+rMRa8NuO+tQ
Malware Config
Extracted
njrat
im523
HacKed
necessary-cement.gl.at.ply.gg:50722
1e47435d5e45b5b0c96eb1651a6c9cf8
-
reg_key
1e47435d5e45b5b0c96eb1651a6c9cf8
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1
Files
-
ac8a1912f246921d24eee850f76b16c24e917749f97a625634a1ee825df98bc1.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ