Behavioral task
behavioral1
Sample
rt.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
rt.exe
Resource
win10v2004-20250217-en
General
-
Target
rt.exe
-
Size
37KB
-
MD5
296c28c5a495c790a1c77b437e285776
-
SHA1
b0e9148e830a742df91c747d5f7b8d15972f4278
-
SHA256
0d3d19710aa393ac6fa112664a2fe68df17e4c70b0408c741cf3b341794f9841
-
SHA512
7bb5c5bd63443c7923665e9a13a340fa6d5da098715a3b20cc63820251e2d7d765cc829f6d2d0d6d16e6e9b459f12346b8e51071cb24435b2e6e4c673db2be30
-
SSDEEP
384:qd2z3hUidkiXR21cGMy8PuuRXBdGFlK6IurAF+rMRTyN/0L+EcoinblneHQM3ep6:O2z3VLGv8PuuRzG66XrM+rMRa8NuRat
Malware Config
Extracted
njrat
im523
HacKed
100.96.164.62:2828
0bfc31f2654d04146a65f405d79d173e
-
reg_key
0bfc31f2654d04146a65f405d79d173e
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rt.exe
Files
-
rt.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ