Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20240508-en
General
-
Target
New Client.exe
-
Size
65KB
-
MD5
305b9050f305abc3f25370b9e70ad41c
-
SHA1
5c05d87ee948579cdad40aecc5fb5918c428c4a2
-
SHA256
3ede10137560c7995f6a0a1b66c0fed309e55973d8ea37969c0921b77a4abfcd
-
SHA512
5fe14b1b816c67e2b288616b30e367f8f64041564e2abd0f0730fbc7d5fa2f3db5615dda62604b2dfe3c0d9e225d23b19060612f74b149409fab22a57869756d
-
SSDEEP
1536:LLqKkTm4BoN36t4QviFw1ijtkBnvAcfLteF3nLrB9z3nlaF9bJS9vM:LLqKkC4BoN36t4QviFCyKBn/fWl9zVa9
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:1504
Client.exe
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource New Client.exe
Files
-
New Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ