Behavioral task
behavioral1
Sample
6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387N.exe
Resource
win10v2004-20241007-en
General
-
Target
6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387N
-
Size
37KB
-
MD5
2ab5d8c77b69c83b4586327b4e5b1ac0
-
SHA1
4bb9f0235b34646e144a737b4411bf8b9b54fa84
-
SHA256
6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387
-
SHA512
370895216cf89f160fb7b8a8413b820a91b6bad1b4073648418f31ed39a3d55476564bf0809ac28cc7e041eaf1fbe7a08b1a28aafd2dd8624e1c638013ade608
-
SSDEEP
384:EuOIiu/jtD+P3V+y0bFwRktv7ms2cPPrAF+rMRTyN/0L+EcoinblneHQM3epzXeG:xXmV10bFwRktalc3rM+rMRa8NuQ5st
Malware Config
Extracted
njrat
im523
HacKed
127.0.0.1:5552
530243754b22224b529f98e07e5b54cd
-
reg_key
530243754b22224b529f98e07e5b54cd
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387N
Files
-
6e6d4fc9df4cbbe2aa3891448cd2bb7dd5f0bfb4396f6c76ed794292cebac387N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ