Behavioral task
behavioral1
Sample
08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8.exe
Resource
win10v2004-20240704-en
General
-
Target
08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8
-
Size
37KB
-
MD5
94774993d5a1b10a274fd7fd6b705b91
-
SHA1
5b34924da254308c1dfb65e2917a5243a97b4fb1
-
SHA256
08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8
-
SHA512
9c161763b07ca69c2fc6b94daea631f0e8dfadcd17ee3d47ec80ad327fdf4e4ef86b7465b70d885ecae375694fd34ee5cf1d50f3b2e495bec1821aa01f66d49d
-
SSDEEP
384:Zate5aNitbFbOn0aH2ykrkmPbZ4znCSqrAF+rMRTyN/0L+EcoinblneHQM3epzXs:Qt7MNWtkrkmzuDCFrM+rMRa8Nu0Pt
Malware Config
Extracted
njrat
im523
HacKed
127.0.0.1:53839
740cd978a472068d5a59d623b2021a99
-
reg_key
740cd978a472068d5a59d623b2021a99
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8
Files
-
08781af3973e8b631cd726c3b69224cdee334e9b0de67fdcaf754c5c8673a0d8.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ