Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe
Resource
win10v2004-20241007-en
General
-
Target
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
-
Size
903KB
-
MD5
bd5494546a6eeb7543f728c32b23eca6
-
SHA1
a7269d4e1357a79aac11f8b670122b943cf2c137
-
SHA256
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
-
SHA512
f3b691414f913c83011ae165287bba1211195489724dd69448a8f53d70f30510a34a377278ad1d373dcba317bd8516afd97911a8d3f09f3f669da4cad5ba0f05
-
SSDEEP
3072:HEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEA93TEAZ:HRRRRRRRRRRRRRRRRRRRRJ
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
com-elephant.gl.at.ply.gg:63355
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512
Files
-
709d01e2059255e29bf003d6b94cd2514b2fad1c7760d06cc3c1d52ffb0fb512.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ