General
-
Target
tmp6e0rdviy
-
Size
37KB
-
MD5
96903e1d3c6f9ac5bd32701a063197ae
-
SHA1
1cd8fb848cf6d02e69e62f2a480a6a6233c58450
-
SHA256
0b0c8fb59db1c32ed9d435abb0f7e2e8c3365325d59b1f3feeba62b7dc0143ee
-
SHA512
be55c9f82b56e00770a79dd3c77661d525a3ee2931b8cecd29fc1524da2c7c28136423820226628f4a204e8fb9c0fcc93a219cf875385b0c1a3c6c9b4e1141ab
-
SSDEEP
768:EifYl2KhhIwdpszJnq1MYrM+rMRa8Nu2/t:EiCIwd+dnqqj+gRJNh
Malware Config
Extracted
njrat
im523
HacKed
https://nbw49tk2-25505.euw.devtunnels.ms/:25505
af63c521a8fa69a8f1d113eb79855a75
-
reg_key
af63c521a8fa69a8f1d113eb79855a75
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp6e0rdviy
Files
-
tmp6e0rdviy.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ