Behavioral task
behavioral1
Sample
d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333N.exe
Resource
win10v2004-20241007-en
General
-
Target
d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333N
-
Size
93KB
-
MD5
77290e15804679684f8ca4aa6691c3f0
-
SHA1
5ebabea149c5126d7530ea62821a9e21a8264ac9
-
SHA256
d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333
-
SHA512
10b86afc0788e077662bb107cbab21651545fe51535a089d53dd4e097ff63b58f32dd327642e0a43a64743e404637c6c27179b240244715e63114652e48b2e0a
-
SSDEEP
1536:VU/r7EkrjaFIs7E5OxzJn8LjEwzGi1dD6D+gS:VU7jau5OVVni1dcj
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
1.248.110.117:6522
32ff384f428118177a2593d72a845212
-
reg_key
32ff384f428118177a2593d72a845212
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333N
Files
-
d9c45d9161929da4e7181ccc59e81b50f3351396655e693b4e1f6e403bec2333N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ