Behavioral task
behavioral1
Sample
d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
Resource
win10v2004-20241007-en
General
-
Target
d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
-
Size
23KB
-
MD5
95e5c3870eca37058e843dc41daf042e
-
SHA1
3e3a771c03d9ef0340b91733f870bc26ced1228f
-
SHA256
d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee
-
SHA512
184f0a0f2ccdb9994d7f58ef322cba39686c56f89bae6846e597db0da5811e368a8f7e8b7acfe7b38a94e074a6b95df4ebac969691c9c016e27e34efff3e86c1
-
SSDEEP
384:poWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZQ7J:+Juk9pHRpcnuFJ
Malware Config
Extracted
njrat
Madest 0.7d
HacKed
neexileeee.ddns.net:1604
ad223c181f76c0d1c9788200b640f54f
-
reg_key
ad223c181f76c0d1c9788200b640f54f
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
Files
-
d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ