Behavioral task
behavioral1
Sample
0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7bN.exe
Resource
win10v2004-20240802-en
General
-
Target
0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7bN
-
Size
36KB
-
MD5
98def32e79167acaee15393662cd3300
-
SHA1
f432047876d651ab4dae941f3dc2eac46e50bcd7
-
SHA256
0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7b
-
SHA512
8ca7a1c1727f91a110832448c862271abecd57a5ef60b54fbfa2afbf31307932d36c0f242d1d1e4ca988008b61bb20d217aa94d5939cb1f078d98147594dec9d
-
SSDEEP
384:d+bsiDlT95hL5YyUvjh/xOi4aaF3ArAF+rMRTyN/0L+EcoinblneHQM3epzXFNrG:g5v5zUvjhDlaRArM+rMRa8Nu/Yt
Malware Config
Extracted
njrat
im523
HacKed
binacian2018811.servehttp.com:5552
6249c924746f5a38f2dc642106909bd7
-
reg_key
6249c924746f5a38f2dc642106909bd7
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7bN
Files
-
0ba9049b0e1f41c42e6314c9c7d8f210d8f47ad19aa35615937375e891ac2b7bN.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ