Behavioral task
behavioral1
Sample
e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772.exe
Resource
win10v2004-20241007-en
General
-
Target
e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772
-
Size
23KB
-
MD5
c0a157cfb82241dd74a75354c4c05095
-
SHA1
8b9276cc5c7736543ea9226de779cba7ae317af7
-
SHA256
e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772
-
SHA512
c59737efb4b685b7441ea20b9f76901111dcac7dd753d86afed0658d97ada14de198f1c9f2e22e9b79b6fde9fb9548b4ba21320bd2ddaeac69d46dfa0b93c325
-
SSDEEP
384:iQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZHh:9LL6MVU0NRpcnuK
Malware Config
Extracted
njrat
0.7d
HacKed
10.10.1.11:5552
59da4ba4e355635c767b06d85318b684
-
reg_key
59da4ba4e355635c767b06d85318b684
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772
Files
-
e80d3d175e0a8a9dbaf216c5ff350ec02d4c514f533dc22c4d7276bc87145772.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ