Behavioral task
behavioral1
Sample
3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4.exe
Resource
win10v2004-20241007-en
General
-
Target
3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4.exe
-
Size
27KB
-
MD5
1313b64e687ec6daf453235e52ba1b92
-
SHA1
b00d9d8bf5378c5f6db21b20ca44ffb4dbca71fe
-
SHA256
3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4
-
SHA512
d505daa52c3261dcc3ebe612d04457229085e050a002e8008aa0f37172dd532e3c6c217c8178a90b320f3b75166385b6f8ede178610f7a76972eac11b5ed4513
-
SSDEEP
384:o0bUe5XB4e0XmObEc6WQzHWT8tTUFQqz9MObbe9:dT9Bu1wcrQVabe9
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
seznam.zapto.org:5050
1e21c2fe0de74
-
reg_key
1e21c2fe0de74
-
splitter
@!#&^%$
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4.exe
Files
-
3988e810ec1766270e91f97325e9234241d547199d22d5910afef0e759c971d4.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ