njrat | 9228D8C44CDC5CC4D82EC3FE68379C6C5938BC04702CF[.]exe

General

Target
9228D8C44CDC5CC4D82EC3FE68379C6C5938BC04702CF.exe
Size 6.2MB
Sample221025-1tb64aeadk
SHA256 9228d8c44cdc5cc4d82ec3fe68379c6c5938bc04702cfc86b9b8c96872b52a68
MD5 cc95e0f6886ee79017f070ceedbb17e3
SHA1 e628e3331228741760644b0716b6e66f7a37324c
SHA512 f50b798226c81db56187e59b258d2e857dc28da6cb42a047e0ffb5da2dc4c95f68d3d8788cec8a15635718a345d98f8c2c5e579101cbd88493e2d4805d7f5136
SSDEEP 98304:u5hHwzlKTDbdRGQSxUTZeNEiIK176ykGlnrHL21sHHLrHIatQts6mughHLo:uwzoTDp4QeUpg176KlnrHiGYDdmughH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pyinstaller njrat

Malware Config

Signatures

Njrat family
njrat

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

File Explorer

9228D8C44CDC5CC4D82EC3FE68379C6C5938BC04702CF.exe

.exe 6.2MB

9228D8C44CDC5CC4D82EC3FE68379C6C5938BC04702CF.exe

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 9228d8c44cdc5cc4d82ec3fe68379c6c5938bc04702cfc86b9b8c96872b52a68
MD5 cc95e0f6886ee79017f070ceedbb17e3
SHA1 e628e3331228741760644b0716b6e66f7a37324c
SHA512 f50b798226c81db56187e59b258d2e857dc28da6cb42a047e0ffb5da2dc4c95f68d3d8788cec8a15635718a345d98f8c2c5e579101cbd88493e2d4805d7f5136
SSDEEP 98304:u5hHwzlKTDbdRGQSxUTZeNEiIK176ykGlnrHL21sHHLrHIatQts6mughHLo:uwzoTDp4QeUpg176KlnrHiGYDdmughH
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Pyinstaller

pyinstaller

Minor OS version

Major OS version

Entry point

12872

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing