Overview

overview

10

Static

static

10

1.exe

windows7_x64

6

1.exe

windows10-2004_x64

6

10.exe

windows7_x64

10

10.exe

windows10-2004_x64

10

2.doc

windows7_x64

10

2.doc

windows10-2004_x64

1

3.xlsx

windows7_x64

10

3.xlsx

windows10-2004_x64

1

4.exe

windows7_x64

10

4.exe

windows10-2004_x64

1

5.exe

windows7_x64

10

5.exe

windows10-2004_x64

1

6.exe

windows7_x64

10

6.exe

windows10-2004_x64

10

7.exe

windows7_x64

10

7.exe

windows10-2004_x64

1

8.exe

windows7_x64

10

8.exe

windows10-2004_x64

10

9.docm

windows7_x64

10

9.docm

windows10-2004_x64

10

rip.bat

windows7_x64

10

rip.bat

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rip.rar

  • Size

    5.6MB

  • MD5

    72db0a49acb0d9475fc6cfc21fe9e229

  • SHA1

    de54b95eb842ad804b425d8dc74914c5a20ac88f

  • SHA256

    d638abd2e0c80c8ace2de8dc015b3a208916e6c4bd6a081a6fc2c09f8a77bc15

  • SHA512

    0a9e429f422160de4eb26a2c8d096d8ec88faa011a1c710871362638a688450fca3c0b10d0bfd12b5c2f535c13384fd5e57b24d8d1ff55eadbae737ed0420289

Score
10/10
macromacro_on_actionbotnjrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Bot

C2

DanilWhiteNjrat-57320.portmap.host:57320

Mutex

802f813d3810aa536753efbd3390b541

Attributes
  • reg_key

    802f813d3810aa536753efbd3390b541

  • splitter

    |'|'|

Signatures

  • Nirsoft 1 IoCs
  • Njrat family
    njrat
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro

Files

  • rip.rar
    .rar
  • 1.exe
    .exe windows x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Code Sign

    Headers

    Imports

    Sections

  • 10.exe
    .exe windows x86

    68f013d7437aa653a8a98a05807afeb1


    Code Sign

    Headers

    Imports

    Sections

  • 2.doc
    .doc windows office2003

    ThisDocument

    Module1

    Module2

    Module3

    Module4

    Module5

  • 3.xlsx
  • 4.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 5.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 6.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 7.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8.exe
    .exe windows x86


    Code Sign

    Headers

    Sections

  • 9.docm
    .docm office2007

    ThisDocument

  • rip.bat