Behavioral task
behavioral1
Sample
a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cfN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cfN.exe
Resource
win10v2004-20240802-en
General
-
Target
a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cfN
-
Size
29KB
-
MD5
760311844c7277c1093b2329a4457b30
-
SHA1
f680eba0056d8e68976b7acdfb2281522a7929d8
-
SHA256
a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cf
-
SHA512
986c78b2a350da5faa1ea838ee782ab10b2034e605fef1801ec8f06668b6556c366d24022fa0f511586e33f3f2301f6a51bbb152910b9653c84fa26499c30775
-
SSDEEP
384:QQ+qNl7fFwYU+uPnQD56136WmqDoz7e4aGBsbh0w4wlAokw9OhgOL1vYRGOZzKYN:z7qYU+u/mq3Mqa7eQBKh0p29SgRtTB
Malware Config
Extracted
njrat
0.6.4
جديد ديب فريذ وى هند كافى
amma.myftp.biz:1177
5a295eb30a8c4bea86741e429f16b791
-
reg_key
5a295eb30a8c4bea86741e429f16b791
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cfN
Files
-
a48793de08e00cbf27bea2e14c5dfa19cb3a00cf022d5d5aa544c335c411c2cfN.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ