Behavioral task
behavioral1
Sample
5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3N.exe
Resource
win10v2004-20241007-en
General
-
Target
5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3N.exe
-
Size
23KB
-
MD5
6c6e8736a2cbaa7896ef92b28bc657f0
-
SHA1
3bedf6cf7a0ff2f8f2b3b6ba001898d4d3aa8078
-
SHA256
5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3
-
SHA512
b845fdce52c95d67093a2500928e2f725b3fbdb6bd5fc704964fd4c542d635ad92264424c7fe7e05c9f3669795beef62c810872a959cad1e6ec426d09568d162
-
SSDEEP
384:moWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZC6:Z7O89p2rRpcnum
Malware Config
Extracted
njrat
0.7d
HacKed
rudghks.ddns.net:2396
2524e925ffa79acc0b289930a97c6212
-
reg_key
2524e925ffa79acc0b289930a97c6212
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3N.exe
Files
-
5669e32b0b364d4576716c0e516966599447fcb5494d3361d13f241dcffe21b3N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ