Behavioral task
behavioral1
Sample
031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366_NeikiAnalytics.exe
-
Size
93KB
-
MD5
b4abe0608210c74fafc2f22bb39347d0
-
SHA1
1caf40d96b0b05e356524efd20de5852c2dee29f
-
SHA256
031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366
-
SHA512
6e0d314374b4738a89ee94276e85415cd45fdb48478e1cc2335b72860385949ede7074d7573992ce57e7bc0034b7d9bb88ac37f524baf24f8bf7793b35553050
-
SSDEEP
768:zY3gGaPqQVfwMjsJIf92ZX1oyIOD2ad1P1qxOtboJHLbKMGdRXWbIFQlhQ2Xxrj9:ZGfQ9IP+J7GHmlpjEwzGi1dDRDngS
Malware Config
Extracted
njrat
0.7d
hakim32.ddns.net:2000
62.221.90.246:25565
35de62f77bf23548692e162f0db183c7
-
reg_key
35de62f77bf23548692e162f0db183c7
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366_NeikiAnalytics.exe
Files
-
031bf88fac2a1c69361e0d4b686882776483d11fbef638f03a32b9c80f949366_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ