Overview
overview
10Static
static
10Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1Plugin/Mic.dll
windows7-x64
1Plugin/Mic.dll
windows10-2004-x64
1Plugin/cam.dll
windows7-x64
1Plugin/cam.dll
windows10-2004-x64
1Plugin/ch.dll
windows7-x64
1Plugin/ch.dll
windows10-2004-x64
1Plugin/fm.dll
windows7-x64
1Plugin/fm.dll
windows10-2004-x64
1Plugin/pw.dll
windows7-x64
1Plugin/pw.dll
windows10-2004-x64
1Plugin/sc2.dll
windows7-x64
1Plugin/sc2.dll
windows10-2004-x64
1Stub.xml
windows7-x64
1Stub.xml
windows10-2004-x64
1njRAT.exe
windows7-x64
1njRAT.exe
windows10-2004-x64
1njrat 0.6....ig.exe
windows7-x64
10njrat 0.6....ig.exe
windows10-2004-x64
1stub.ps1
windows7-x64
1stub.ps1
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Mono.Cecil.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Mono.Cecil.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
NAudio.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
NAudio.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Plugin/Mic.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Plugin/Mic.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Plugin/cam.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
Plugin/cam.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Plugin/ch.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Plugin/ch.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Plugin/fm.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Plugin/fm.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Plugin/pw.dll
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
Plugin/pw.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Plugin/sc2.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
Plugin/sc2.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
Stub.xml
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Stub.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
njRAT.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
njRAT.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
njrat 0.6.4 config.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
njrat 0.6.4 config.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
stub.ps1
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
stub.ps1
Resource
win10v2004-20220812-en
General
-
Target
8b875dea6f06648b980ca2e886db57ae69750485f92f5ac0c3994189b3017cc4
-
Size
1.4MB
-
MD5
e9e855f5e1ff15983a5c44a48c91d761
-
SHA1
afe35689801b6d611c94b1b0f27c824c8b849b04
-
SHA256
8b875dea6f06648b980ca2e886db57ae69750485f92f5ac0c3994189b3017cc4
-
SHA512
fa2646707393e4fd3c431382dcfb02b655ea25821e553fa4768a8e8142c7639dc533b344b7bc6556cd7a8add13c98e36f164acb1c9ce57bfa719c732f3866c29
-
SSDEEP
24576:syf+FQa+iNcXCnKv7B21o5j9mrtAcI4tdUlyeVEVniUGSa7DP3qmR3dxBwrxF:sk+xNcXfLAJA/NoeVKiNVnPamPxBwtF
Malware Config
Extracted
njrat
0.6.4
Prince Muhammed
iammuhammed.noip.me:1177
ba4c12bee3027d94da5c81db2d196bfd
-
reg_key
ba4c12bee3027d94da5c81db2d196bfd
-
splitter
|'|'|
Signatures
-
Njrat family
Files
-
8b875dea6f06648b980ca2e886db57ae69750485f92f5ac0c3994189b3017cc4.rar
-
GeoIP.dat
-
Mono.Cecil.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NAudio.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 380KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/Mic.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 406KB - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/cam.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/ch.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/fm.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/pw.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Plugin/sc2.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Stub.manifest.xml
-
njRAT.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 864KB - Virtual size: 863KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
njrat 0.6.4 config.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
stub.il.ps1