Behavioral task
behavioral1
Sample
2c0296f6aa1e43ddd6f45b47312b9a90N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c0296f6aa1e43ddd6f45b47312b9a90N.exe
Resource
win10v2004-20240802-en
General
-
Target
2c0296f6aa1e43ddd6f45b47312b9a90N
-
Size
37KB
-
MD5
2c0296f6aa1e43ddd6f45b47312b9a90
-
SHA1
c97b950e463cbbac1fbf56984ee49c803580e51e
-
SHA256
b7636040051527e7ab3f4745f1cfd2260d74d64a646666d88b678adbf24142a1
-
SHA512
3ed6a4884fe426b37d177ecde0f4a5a49ed7f842ea29c9fd0c2a238bfda311ff44539d3cf9ef78712b4ecb5e466820775b722dbc0bf1eb566d2fcffcb8623738
-
SSDEEP
384:dbzoUiFmbK7FmpE8QyEfGqvR2f3KVKrAF+rMRTyN/0L+EcoinblneHQM3epzX16L:NF2n8LEfGqAfKArM+rMRa8NuT6Zt
Malware Config
Extracted
njrat
im523
HacKed
193.235.207.126:5865
f1d4287beeb567a043ef46f75fb7be85
-
reg_key
f1d4287beeb567a043ef46f75fb7be85
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c0296f6aa1e43ddd6f45b47312b9a90N
Files
-
2c0296f6aa1e43ddd6f45b47312b9a90N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ