Behavioral task
behavioral1
Sample
be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0.exe
Resource
win10v2004-20240802-en
General
-
Target
be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0.exe
-
Size
32KB
-
MD5
5b2f10435b1931da90208167cd12380f
-
SHA1
2cb042ea933b1ccffff8ae8cf84cd07641525a1d
-
SHA256
be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0
-
SHA512
a1fe08be1d71643f3022f0e81068f067f4c8732ef36b53e9c5b8d61892897545af91f4c152171d56ceda3b50e39a4710b819d8fc7a56274098011b5554f0b592
-
SSDEEP
384:90bUe5XB4e0X6OxLw0Q0mS03AWTxtTUFQqzFzObbt:uT9BuJC55dJbt
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
192.168.1.7:8080
0e288d5e077445f9b93
-
reg_key
0e288d5e077445f9b93
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0.exe
Files
-
be2600ebccd8ec339463b7927783c0465f3cdb2979663478619073b9e1773db0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ