Behavioral task
behavioral1
Sample
dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0N
-
Size
32KB
-
MD5
b2a6d2244763148bc1e717845cc1c740
-
SHA1
fd3285b4493ee3e7f68a0c53459e31774b1cc8f9
-
SHA256
dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0
-
SHA512
742c7048a57b522b1b942bb45177b496cd5330ea108da94af4f23cdeb584af57024cde717eb40e85f9c567ed7166229bb0423a1381ac99d5bf5110d45c57a9a6
-
SSDEEP
384:00bUe5XB4e0XuOJ6ggUBZIGcWTYtTUFQqzF/Obb0:RT9ButgggUBZIzFb0
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
maravillas2022.duckdns.org:9510
95e474bc16ec42bc
-
reg_key
95e474bc16ec42bc
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0N
Files
-
dcf98ceb9b78fe707639266af4feae4649e60c6224a41d0dc2da2f5637bb41d0N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ