Behavioral task
behavioral1
Sample
28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c.exe
Resource
win10v2004-20241007-en
General
-
Target
28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c.exe
-
Size
93KB
-
MD5
082ed356940b12a76378f7b28ac59ee2
-
SHA1
03f85a2a4947a7c21b719b0a711a33bda85b3c27
-
SHA256
28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c
-
SHA512
72f5182ea437d66372c808045cf34868fc447aceaceb886a36b55b96cbc94a960ff1e3153f3961dad129c186e8440741ae4a96ac9298d7be5a6081a8332030a9
-
SSDEEP
768:LY3WgBBkpjTMpALPGMtsas88EtNXhe9f1mxCXxrjEtCdnl2pi1Rz4Rk3KsGdpSgr:zgjkVbPGHz88EbW1pjEwzGi1dDmDSgSA
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
127.0.0.1:7777
f24666adf22d8a7ee39c578f56a54267
-
reg_key
f24666adf22d8a7ee39c578f56a54267
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c.exe
Files
-
28fdca28192129132697fd2351bddf5262d195ca8213b2cd4214777f08ad088c.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ