njrat | CxZpMQSz[.]exe

General

Target
CxZpMQSz.exe
Size 37KB
Sample220227-nyfnvsdeam
SHA256 5ccee64d7cda44cac1e1ebe9be61d2888c2d28dfa0c8cf0e255fe8b153cad342
MD5 4519b2d0617dcbb6d85ae78815e287c3
SHA1 88f0054d728f6ed03fd95c6304ff6a2357b2e8bf
SHA512 ae9c47cf3f4bd793256cad5deeee21f4c317e9e93fb10351779dce7f209f3d9d1407177295ba80aae4c947c829b317d5ada60b122f691a43ca218dea835fc8b0
SSDEEP 384:qgOs0IiejvCVLO309QmykrtG+dA+VfwvOSHscrAF+rMRTyN/0L+EcoinblneHQM:yFdGdkrgYRwWSMcrM+rMRa8Nu78t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

name.bounceme.net:4545

Mutex

5937e76b9b6eeb3102ada594161ade6d

Attributes

reg_key
5937e76b9b6eeb3102ada594161ade6d
splitter
|'|'|

Signatures

Njrat family
njrat

File Explorer

CxZpMQSz.exe

.exe 37KB

CxZpMQSz.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5ccee64d7cda44cac1e1ebe9be61d2888c2d28dfa0c8cf0e255fe8b153cad342
MD5 4519b2d0617dcbb6d85ae78815e287c3
SHA1 88f0054d728f6ed03fd95c6304ff6a2357b2e8bf
SHA512 ae9c47cf3f4bd793256cad5deeee21f4c317e9e93fb10351779dce7f209f3d9d1407177295ba80aae4c947c829b317d5ada60b122f691a43ca218dea835fc8b0
SSDEEP 384:qgOs0IiejvCVLO309QmykrtG+dA+VfwvOSHscrAF+rMRTyN/0L+EcoinblneHQM:yFdGdkrgYRwWSMcrM+rMRa8Nu78t
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

43966

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing