General
-
Target
t.exe
-
Size
31KB
-
MD5
c0d519148954e4371935e39c65f6b128
-
SHA1
a54ad956b40d196916803acd3f3935987a98aa6d
-
SHA256
659518fef60aeda5e66ae2f295c5adfe1fe8662a62c644ef53225c111c110f99
-
SHA512
7be75b0ddd3e26ab53b337722440eedcd6bf74d5dc20547dc8edd598dfa1c97497b8326d5dc1eb02b93283832723235dd888d147ba7e71bbb3f926c6ca60cbf5
-
SSDEEP
768:jrhO5b13hdwzxLy3os0O/dMRvCnQmIDUu0ti8Bj:3cZ6eh6gQVkVj
Malware Config
Extracted
njrat
0.7d
test
192.168.1.113:5552
3b20645f1dd1439285bb01938f959e0c
-
reg_key
3b20645f1dd1439285bb01938f959e0c
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource t.exe
Files
-
t.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ