Behavioral task
behavioral1
Sample
87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a.exe
Resource
win10v2004-20240802-en
General
-
Target
87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a.exe
-
Size
32KB
-
MD5
00596e7ce8458d41034fe97d6e3a7979
-
SHA1
99b51bdad912e66ab181b0bedb9d7e8643ae7924
-
SHA256
87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a
-
SHA512
4276681b4b873aa466e3e4f04accf9dc4410eca8aebeb64a11322936a1304a7379e449af437188ea2d25da5c152b433679a422728b4aca111e31e25fbdfd1c73
-
SSDEEP
384:20bUe5XB4e0X1gONvw0Q0mS03AWTxtTUFQqzF7ObbJ:XT9Bu5C55dBbJ
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
192.168.1.7:8080
3111e69309c94ba99
-
reg_key
3111e69309c94ba99
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a.exe
Files
-
87b0a6a233ea403868b58ac1960ad6799785a06b684c38e5517a9254a544145a.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ