Behavioral task
behavioral1
Sample
spoofer.exe
Resource
win11-20240611-en
General
-
Target
spoofer.exe
-
Size
93KB
-
MD5
9f63eb3b3e764f65279a72aba2a7ab3c
-
SHA1
e80d0a688504c9d2c8bc2c75c4858c125376e73f
-
SHA256
044cb93b9b488b1f8db597b62bc989f7c6e79a5942593bf351236a271a8fc2c6
-
SHA512
a23cd7dfb128dc3143defc85c958042f3ae555a5654c081bd6158b83e16d73813f69f5da30187b251e7ef8b2078e7e681bcf84fcc66f646a8100bdd0aa71082e
-
SSDEEP
1536:SVp78lZc+/2HVzvdzDxffvqjEwzGi1dDcHbAgS:SVpoc+/2HVzFzDxn7i1dmp
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
7.tcp.eu.ngrok.io:5555
9e1fd59a82ee1db40e91292d21f617f9
-
reg_key
9e1fd59a82ee1db40e91292d21f617f9
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource spoofer.exe
Files
-
spoofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ