Behavioral task
behavioral1
Sample
Client.exe
Resource
win10-20240221-de
General
-
Target
Client.exe
-
Size
32KB
-
MD5
2f69cc743599f71091628b4900ef537d
-
SHA1
c7ca73ab72b10e0c794bbafcb0ee0301563fdab1
-
SHA256
3e5ff7e6ce8428b777e3fdb905f82ef214911521334b7614741c1fad722e6522
-
SHA512
f3345e5c5bc50a2eb5ba0753fa43a137171aad327e540c091dd8c1d98342a605c124983ca5ecfacbdea2691d0079f1539742a63c83b4f4be2e54c3240a426931
-
SSDEEP
384:f0bUe5XB4e0XwOzDw0Q0mS03AWTxtTUFQqzF6Obbl:UT9Bu3455dYbl
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
telebit.cloud:32364
4c6b4293560
-
reg_key
4c6b4293560
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ