Behavioral task
behavioral1
Sample
xsafdssfs.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
xsafdssfs.exe
Resource
win10v2004-20240802-en
General
-
Target
xsafdssfs.exe
-
Size
93KB
-
MD5
439c761eaa44f0038e2a4c6870fbff2a
-
SHA1
44db854e6d0a019190b47c1befca45b2f807dfcf
-
SHA256
724eb54199d046043a26873c70d4b95afde7db3571b6ce0fdcbf47f1f007c074
-
SHA512
15404b468a16ea25476289e372c47f14b7b4f861db20f447b74e725ee7d968d484cfa49648054c1e7a43b39d20dae5e7d443ca68ef06d0dc2e7c51f7a07ae173
-
SSDEEP
1536:nGNlF9j+90I+IDoJYcjEwzGi1dDpDzgS:nGnj+90FhG9i1d9s
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
since-searching.gl.at.ply.gg:64197
17a9810093f2532958d910fd86a31035
-
reg_key
17a9810093f2532958d910fd86a31035
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xsafdssfs.exe
Files
-
xsafdssfs.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ