Behavioral task
behavioral1
Sample
b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe
Resource
win10v2004-20241007-en
General
-
Target
b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe
-
Size
93KB
-
MD5
a9ba2416df448c5f3b36581ecfa4cd31
-
SHA1
105592c84c83cbf4e6f7b6978ecb6d37c99440b7
-
SHA256
b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf
-
SHA512
456ffb46cf5d914108a68292e1f9e73665e7dd3905015c76709ecc954d02b50d9dfdd758c2178791d75aa1010b7c0f2e0cf92659f2471a227497343477e6c9f3
-
SSDEEP
768:+Y3DCdhWXxyFcxovUKUJuROprXtgN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3GsGdpQgM:hCzWhIUKcuOJXPhBjEwzGi1dDiDQgS
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
127.0.0.1:5513
67364a37f43593883a7b70eb2426799a
-
reg_key
67364a37f43593883a7b70eb2426799a
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe
Files
-
b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ