Behavioral task
behavioral1
Sample
53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e.exe
Resource
win10v2004-20241007-en
General
-
Target
53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e
-
Size
31KB
-
MD5
1dcca57041c8e9e0d00c989d3c9dec4c
-
SHA1
a4d7ef9eb5756c4cb06f0760b73b169a6bf926f4
-
SHA256
53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e
-
SHA512
1e5255c9ff3e0691c8581a1d0687a0b2176f6d82983414eb05d44b188544a81d5cf1e7751107c0aa662d17eb27f19a380dc9f2f91f3817ef88c02ba5386b2c6d
-
SSDEEP
768:WFijnXuTthUzxf6rnYA/bh9vUpQmIDUu0tiwJhj:dn+K+PAQVkNj
Malware Config
Extracted
njrat
0.7d
white_admin
127.0.0.2:100
1b2ab263668640fad25298dfb1c138d6
-
reg_key
1b2ab263668640fad25298dfb1c138d6
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e
Files
-
53c01d4af6da8c4e7f971db1305275e521550cbb5fb50ae7122b26b91b4f7d9e.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ