Behavioral task
behavioral1
Sample
7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822.exe
Resource
win10v2004-20231215-en
General
-
Target
7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822.exe
-
Size
32KB
-
MD5
287fbbbc69050158902e5a297a4693bf
-
SHA1
ac8fea9c0d591a0dc8d46e6e1450e79697c62596
-
SHA256
7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822
-
SHA512
a22cf7084ff85567bc482b7da5cf8cd2d78c4b5653c1b87cc23ad3cf1330b836f87300a84fb67a34177a15179ad21218b296c5a35b79fe5b43725cb77e74ea3e
-
SSDEEP
384:Q0bUe5XB4e0X7OZOiaXLilpknDAWTEtTUFQqz9eObbG:VT9BuCjaXWlZwbG
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
patria.duckdns.org:1995
654d824fdca24744
-
reg_key
654d824fdca24744
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822.exe
Files
-
7d86de2d2e6cd118653666fd446f52370e890e3f72ba30de620abdea1f514822.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ