Behavioral task
behavioral1
Sample
539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20N.exe
Resource
win10v2004-20240802-en
General
-
Target
539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20N
-
Size
23KB
-
MD5
22f91e626d0fe5a846faa521ee222760
-
SHA1
6e32cc6a1e766666e1d6a0b2ccc934546586afe5
-
SHA256
539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20
-
SHA512
89c377af07431696b8903d2ed698c5a6a29ee16f5d2a385659f804fa39c97d6516da96a463dc3ac84eb22a1fcbfebea95d0950b31a4b48bb358b80470be0886a
-
SSDEEP
384:68aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZM+:kY+sNKqNHnSdRpcnu4
Malware Config
Extracted
njrat
0.7d
MyBot
777ys.cc:3339
88a4b49c2c04ad4a3eef175140304af8
-
reg_key
88a4b49c2c04ad4a3eef175140304af8
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20N
Files
-
539c30c4e7235d64fd756efb20269392c66c63cb295d8c7a2349befd10974d20N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ