njrat | b34b260c4e200213ffb77f02cb4471eb[.]exe

General

Target
b34b260c4e200213ffb77f02cb4471eb.exe
Size 43KB
Sample220424-vp83daeabl
SHA256 29c2ba9035cdd613e5cf38e3441a3be91e39c724707659a6473b0e4e24e4bb38
MD5 b34b260c4e200213ffb77f02cb4471eb
SHA1 526ed79466ab1c921aa41f8e699fe24021d57d75
SHA512 d740b113c562cc8f7b792c581a4eabbb0fe896c2b98f34608e717b2c3ec8ac980985a5dd4da3b1f08ae9991e2e75973d4a478915bbd28420c737ab0ab8e2130a
SSDEEP 384:TZyI4DYolYxOoyi0WZ6w7egEx88FQPzgIij+ZsNO3PlpJKkkjh/TzF7pWncsgre7:dTouIli006weh8awuXQ/opI+L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

puff njrat

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

PUFF

C2

8.tcp.ngrok.io:17196

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Njrat family
njrat

File Explorer

b34b260c4e200213ffb77f02cb4471eb.exe

.exe 43KB

b34b260c4e200213ffb77f02cb4471eb.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 29c2ba9035cdd613e5cf38e3441a3be91e39c724707659a6473b0e4e24e4bb38
MD5 b34b260c4e200213ffb77f02cb4471eb
SHA1 526ed79466ab1c921aa41f8e699fe24021d57d75
SHA512 d740b113c562cc8f7b792c581a4eabbb0fe896c2b98f34608e717b2c3ec8ac980985a5dd4da3b1f08ae9991e2e75973d4a478915bbd28420c737ab0ab8e2130a
SSDEEP 384:TZyI4DYolYxOoyi0WZ6w7egEx88FQPzgIij+ZsNO3PlpJKkkjh/TzF7pWncsgre7:dTouIli006weh8awuXQ/opI+L
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

50046

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing