Behavioral task
behavioral1
Sample
7f1ca96d5c7c9cc6246fb37d4efb6bd4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f1ca96d5c7c9cc6246fb37d4efb6bd4.exe
Resource
win10v2004-20231215-en
General
-
Target
7f1ca96d5c7c9cc6246fb37d4efb6bd4
-
Size
32KB
-
MD5
7f1ca96d5c7c9cc6246fb37d4efb6bd4
-
SHA1
44540a32d0dc743c5d14a827ef658fe495606d92
-
SHA256
c88356af063fd3ee288050827af8269721404796b0124b939bb9c5464aacb1cc
-
SHA512
dea58f239ccb2a4a3fe34bd74c672fa563754fd4cf53314d255a433b105c7be351759065b935430bb880c946110eba925c148ec8bb7661bc8d6044ae8efec2cd
-
SSDEEP
384:u0bUe5XB4e0X+ODCANuiEO0YaaWTVtTUFQqzFEzObb1:/T9BudOguiEYg0b1
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
21aciu9obz2dggfn0acid1319b9bacaf3b6bb.duckdns.org:1235
4f32434d5e0345db
-
reg_key
4f32434d5e0345db
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f1ca96d5c7c9cc6246fb37d4efb6bd4
Files
-
7f1ca96d5c7c9cc6246fb37d4efb6bd4.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ