Behavioral task
behavioral1
Sample
Lammer.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
Lammer.exe
-
Size
23KB
-
MD5
8ef1c362e7a42893a331a657d021d665
-
SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8
-
SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab
-
SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299
-
SSDEEP
384:hYmdk8XvCJrQLdRGSiEYH7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZFP:WwWktitaeRpcnuS
Malware Config
Extracted
njrat
0.7d
Lammer
station-gps.gl.at.ply.gg:26933
ded5a8703334377d83da00a864706211
-
reg_key
ded5a8703334377d83da00a864706211
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Lammer.exe
Files
-
Lammer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ