Behavioral task
behavioral1
Sample
fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541.exe
Resource
win10v2004-20241007-en
General
-
Target
fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541
-
Size
31KB
-
MD5
228910f2d8f90acad48eb9a4c213b69c
-
SHA1
60553d3782d3f23358ecad34fefb7b275726a99c
-
SHA256
fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541
-
SHA512
24c45e184ef7a325404d3cbba8f57461a64b75bf1d305651e4ff399518c38dedf8d2107cdad5b0d2e2506c52bed1cb981ed950b848a03e22c647e07aeff98123
-
SSDEEP
768:7XeZyeOHxtgzxbSHXqrgf9dBvisoQmIDUu0tihGj:2Kauf/voQVkZj
Malware Config
Extracted
njrat
0.7d
Hacked
10.0.2.15:5552
bd996c26f70b64f1b499d2e4beb71ac3
-
reg_key
bd996c26f70b64f1b499d2e4beb71ac3
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541
Files
-
fc2ca4afc70626124f35d0e4251185adf53c224d9fd49b90c16ca00613fe2541.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ