Behavioral task
behavioral1
Sample
9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148cN.exe
Resource
win10v2004-20241007-en
General
-
Target
9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148cN
-
Size
27KB
-
MD5
e4747edafe28a20223d1473a0931b7a0
-
SHA1
f77663e86163b9f54504e44c46890199853bd8c3
-
SHA256
9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148c
-
SHA512
f9d0cfd84013d64b5d07ca69a06a1df7b0d911b1f2765640ce24d4fe8b0465cdb23f37506d4f270056b84d77555d4181be08a91cca79c2d87a644c308cb0e0eb
-
SSDEEP
384:kLyN6BjmgERY/cescmGPiJRjMFAQk93vmhm7UMKmIEecKdbXTzm9bVhca36ir6eR:yL4sVvFA/vMHTi9bD
Malware Config
Extracted
njrat
v2.0
HacKed
21.ip.gl.ply.gg:57655
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148cN
Files
-
9f7e65b1acc1f334f17a44ed71937a44fb8dc14cdd52b0319be0c749b640148cN.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ