Behavioral task
behavioral1
Sample
920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475.exe
Resource
win10v2004-20241007-en
General
-
Target
920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475.exe
-
Size
77KB
-
MD5
51d450bdf07d3564adca2afca6f006c3
-
SHA1
c234d1e8e6b76b70da9511e5a89e687cca175263
-
SHA256
920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475
-
SHA512
cc72dbc1b34b47f97fa86dfd5ac7a64bdd93cd0d70b330601938828ed9c7e3d38c9717bc2e17d941bda931d8782ef69ce11d21ea1373929b649fab80e5aa98dc
-
SSDEEP
1536:sJe+2wvFDp1S5wpOk3JCK6pFotfd6fOpd/9nEh9TGjJ3RI:2QwpOk5CK6XO/9ESjJ3q
Malware Config
Extracted
njrat
0.7.3
Lime
192.168.100.59:6522
Client.exe
-
reg_key
Client.exe
-
splitter
9999
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475.exe
Files
-
920a85cb909841bc249df8872d5a3a89df389990b14af0787c946965895d2475.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ