Behavioral task
behavioral1
Sample
66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75.exe
Resource
win10v2004-20240412-en
General
-
Target
66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75.exe
-
Size
32KB
-
MD5
723480351d4946b6b8dd3e953a4ab4a6
-
SHA1
c58cf420e9555cfc916843437d73965394887f95
-
SHA256
66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75
-
SHA512
603c55850d4dc6dee78faf67702241af36d7767ac9b6504b7bebfcf716322464347a54d61838cbd20f3942cbfaaff2fdf5a365f4128869fc41462c43f0f84d91
-
SSDEEP
384:w0bUe5XB4e0XfOVcsw0Q0mS03AWTxtTUFQqzFxObbR:1T9Bu26555dPbR
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
rusia.duckdns.org:1994
7fc3d7b5df89403
-
reg_key
7fc3d7b5df89403
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75.exe
Files
-
66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ