Behavioral task
behavioral1
Sample
lol.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
lol.exe
Resource
win10-20240214-en
Behavioral task
behavioral3
Sample
lol.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral4
Sample
lol.exe
Resource
win11-20240221-en
General
-
Target
lol.exe
-
Size
214KB
-
MD5
bd367e4170e17df14b5a6a15cdfd79b0
-
SHA1
206cb6b1336d890e2bb8f4f36cf27b9d78ca8b1a
-
SHA256
1b0fb3b5cd0ff954ab04c5502d0be2270181da75cca92f84ab91e4142745ed56
-
SHA512
c62163ea1be9652862112116200ca0153737b7af6b1439b820687c4bbaf52fb616c70bbd3ca55dfe3d24a178a99d831ef6819e685de5e838473b26ea6281b5f6
-
SSDEEP
6144:DXP9zPvM92B+64kQ2EJam2dNREz9FdOZMJwGuE4QyZom8exsrPR5TE7D0XuDTTo6:DX5s2B+64kQHam2dNREz9FdOZMJwGuEu
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:12607
Client.exe
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource lol.exe
Files
-
lol.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ