Behavioral task
behavioral1
Sample
2e5eece252128b7fe494993f6b3f4980N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e5eece252128b7fe494993f6b3f4980N.exe
Resource
win10v2004-20240802-en
General
-
Target
2e5eece252128b7fe494993f6b3f4980N
-
Size
37KB
-
MD5
2e5eece252128b7fe494993f6b3f4980
-
SHA1
6978d246c49482f5b9d9f7b3f988d76e4e43b85e
-
SHA256
2427bd82dbcc0fef8a800af605bd6cb9cf85bc2a1e47b83a927b7254e7193b98
-
SHA512
85de84f7e3cf55d4d0f505a101c1f39e00062338a20aa41be31ff587a674d9f247c00995d9914a135489f19b83bc34ad64a309d3bbd491c767c90b1a687bfc70
-
SSDEEP
384:9QeKIiejZCVLO309QmykrtE0deYnfKvG46drAF+rMRTyN/0L+EcoinblneHQM3eH:izdGdkrK6PKO42rM+rMRa8Nudjt
Malware Config
Extracted
njrat
im523
HacKed
26.55.48.203:5552
f4ea933d516c317cbb8fecf65bdcbc12
-
reg_key
f4ea933d516c317cbb8fecf65bdcbc12
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e5eece252128b7fe494993f6b3f4980N
Files
-
2e5eece252128b7fe494993f6b3f4980N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ