Behavioral task
behavioral1
Sample
a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fcN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fcN.exe
Resource
win10v2004-20240802-en
General
-
Target
a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fcN
-
Size
55KB
-
MD5
7d38e6e8b44aac1d4e7a3eb659837520
-
SHA1
5a7c139618c8eb4ceb1e897a9e41b5cafceaf465
-
SHA256
a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fc
-
SHA512
ae76d28657016ef48aad993ba53ee34a1ccba6f9c8af70ad9b458b3e877b828015ec8f8fd3585b25a579d4cf1aaf5c9e3c9e28b5b6fcf133b67afc4439a6e78b
-
SSDEEP
768:l7kOpEBhA/vMHTi9bDIS+FPPPPrnMXOFc8pnD+orPPPPP:dkOpvnYi9boMXOFcMD+o
Malware Config
Extracted
njrat
v2.0
تم الاختراق من قبل احمد السيسي
mmo7m.ddns.net:7777
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fcN
Files
-
a7356edf0a0c0a2b003ade063ff5d8817c9d73fc3a7b4f4605f03d44cfd602fcN.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ