Behavioral task
behavioral1
Sample
Server22.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
Server22.exe
-
Size
287KB
-
MD5
8416926446f203e874143dd21d534cbc
-
SHA1
0669ed6fa64701b149278e93b7060fc86f1e0950
-
SHA256
701ce077bbe2c27c2496cad43d99ec4c6923c5f56f8d7f286c4e0623a789e79b
-
SHA512
0c255f090613148761abba312fb9256b9dc7a2cd04c01b2745de88012b2928934e06438c3415f1fec40eb6b8f4354b5dd074bcb3b593018fcf6a55ef2b9affc3
-
SSDEEP
3072:pcwb0m2QAsSdADRq6ty71wtYM77ldY7AXTp2kA:5uwH77Ppj0kA
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:8888
a3bfe23a1eca722fceb292fb6eee1294
-
reg_key
a3bfe23a1eca722fceb292fb6eee1294
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Server22.exe
Files
-
Server22.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ