Behavioral task
behavioral1
Sample
ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b.exe
Resource
win10v2004-20240226-en
General
-
Target
ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b
-
Size
36KB
-
MD5
4cb1b5c29ae187e67e6f2e7bd3e37c0c
-
SHA1
f976f0a0de446f20a03c8fb20a06458c12c6dd75
-
SHA256
ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b
-
SHA512
626cc0e1fed36e914399cad88a05ce72dbc400cc4a50ce140f469d469111e87321965bc97787cf168eb20bbf00f1a08bd3ea5e0f61af36448e1965c57af7386e
-
SSDEEP
384:livjKicggjn5xL5oyUi8eL16jnP7UYKoN+rAF+rMRTyN/0L+EcoinblneHQM3epX:Mvif5DUi886jnQlowrM+rMRa8Nut9t
Malware Config
Extracted
njrat
im523
HacKed
political-seasonal.gl.at.ply.gg:12893
1fc5c9e034f63cb7690e02102bbc8bd3
-
reg_key
1fc5c9e034f63cb7690e02102bbc8bd3
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b
Files
-
ef7a1bbdf35b1544502ec029a178f3f74be96a402cda94dd75e4e9c182a76b5b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ