Behavioral task
behavioral1
Sample
NewClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NewClient.exe
Resource
win10v2004-20241007-en
General
-
Target
NewClient.exe
-
Size
167KB
-
MD5
c05d3f2f9e97414951d9a850925aae47
-
SHA1
adf749dcdd4107fd1e9a4c235745e8dbd0c367c1
-
SHA256
7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7
-
SHA512
04c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212
-
SSDEEP
3072:VcMADoN36tnQviFCtABnKfWl9zqaF9bwYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:V9i9z/vM1/JdSI5eb
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:14324
discord.exe
-
reg_key
discord.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NewClient.exe
Files
-
NewClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ