Behavioral task
behavioral1
Sample
536e56b6209a3f0a5893ee64c358beef.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
536e56b6209a3f0a5893ee64c358beef.exe
Resource
win10v2004-20241007-en
General
-
Target
536e56b6209a3f0a5893ee64c358beef.exe
-
Size
118KB
-
MD5
536e56b6209a3f0a5893ee64c358beef
-
SHA1
d7ab63e972d7ce34b39b5a2376318f0e0d10598e
-
SHA256
2a1837f12707bb0c3cb62653750004640a029833f7d7790f1d4ce79507a0dd16
-
SHA512
977a48a9840dd31c29f4cf68b1bad1bcb54df0c1663bba05785431a499ad84c1d7954414012030e895c76d99fb36ab048257b4cea8c377d23aade01319006f6f
-
SSDEEP
1536:K1v54X1LIpe+gRJNDYVSPacFyq9Qhu4lR8CMomjI9FUv9r0HHP0Yp9YN:K1h4F8e+yJF2lcguNrjI9FUvGHvX/
Malware Config
Extracted
njrat
im523
MooReports
154.197.69.14:1433
6dc05a59fd2afdd42871a13a6d06ab6f
-
reg_key
6dc05a59fd2afdd42871a13a6d06ab6f
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 536e56b6209a3f0a5893ee64c358beef.exe
Files
-
536e56b6209a3f0a5893ee64c358beef.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ