Behavioral task
behavioral1
Sample
997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e.exe
Resource
win10v2004-20241007-en
General
-
Target
997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e
-
Size
37KB
-
MD5
6b56460087f1cbe79de1cab679027bcb
-
SHA1
c973993a1df09018f5b6051c8910abdd9ea48e56
-
SHA256
997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e
-
SHA512
5e506645213cae2cf4ba0211af30ab1ac02dfa1157d80ef768bf38f54d638bcdd2171eeb98ec736b489c4c3f6060d005e10305e21aa82ac18aa719dff9e869fa
-
SSDEEP
384:+y7kkmSiUbFgdnP12ywjrzSzLf7S8GsHVrAF+rMRTyN/0L+EcoinblneHQM3epzo:37kkM91twjrzSHGls1rM+rMRa8NuBYt
Malware Config
Extracted
njrat
im523
HacKed loshara
wanted-birth.gl.at.ply.gg:5534
fb26a3a5081bc57c4672ecfe56cfcc2d
-
reg_key
fb26a3a5081bc57c4672ecfe56cfcc2d
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e
Files
-
997d5c3ad783636502a50269466eef1deae0491ef10ab5e1a654dd2088715b8e.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ