Behavioral task
behavioral1
Sample
82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
Resource
win10v2004-20241007-en
General
-
Target
82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
-
Size
93KB
-
MD5
649ccc1f57bab5d308d0b6fdbcb163a9
-
SHA1
d975bb450229faa84814b91248ef63c6a522d3b2
-
SHA256
82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e
-
SHA512
6315458ecc6d116b52a0869d88e30c96d91cdd91d97c7039065a8b0d02ec8137826c1eea0db1cb6be702cdb5d87d65be8ac6b5a3f0de9da47eac848b82304c45
-
SSDEEP
768:0Y33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3zusN:rUxOx6baIa9RZj00ljEwzGi1dD2DFgSk
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
127.0.0.1:58905
5aaa7064cdb598d29f999ea8c3e69c8d
-
reg_key
5aaa7064cdb598d29f999ea8c3e69c8d
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe
Files
-
82d2d7af2ddbe16fdc4dc037489d112d7347384bceb98fbeb13a02ee5dd2b13e.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ