Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20241007-en
General
-
Target
Server.zip
-
Size
37KB
-
MD5
042940a8e5c665f2fcdb2363e0a0ecb9
-
SHA1
90bb14951db17325946d761f0e6925dda46e2840
-
SHA256
15e3f7633e40b1984b8865624bdf8a7993f95af4a544bca2097ec517b406d9d6
-
SHA512
91240732ae9b685965cac235d3397f4abd60330708679ced82aa619cb2e2d06ebd67961f607a4aec6628e57aaf1996dd0ec20cadec26bfc1406f22d9ebd41407
-
SSDEEP
384:eS+6WIiejtCVLO309Qmykrt4QdqMjf+vWEWxrAF+rMRTyN/0L+EcoinblneHQM3X:EHdGdkrOGb+eE2rM+rMRa8Nuistk
Malware Config
Extracted
njrat
im523
HacKed
192.168.0.159:5552
a07dd6977de8bb7c076e254367e125b2
-
reg_key
a07dd6977de8bb7c076e254367e125b2
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Server.exe
Files
-
Server.zip.zip
-
Server.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ