General

  • Target

    New folder.rar

  • Size

    6.9MB

  • MD5

    27f8ef3eb1c6fdbe295174f4fa4ea19c

  • SHA1

    4e5768610fd41604c906729f866d4b97e7dbb276

  • SHA256

    a86957ee594e57dfdf8ffdee89b6ad7465212c8724f5cf524983bee81ea74506

  • SHA512

    94168abe57cf20fb20c17ca1d24aa1395c06d3eb1582f490d967b84b9b025d0613474b0878f375f7d75aa76ba876bee3fa285916090d108ad8324da44bbbab4b

  • SSDEEP

    196608:fYlj8zcAEYvZ4qhytYPoURanwftLalial8:fwAdB4q0WwKanwhaliR

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

according-psp.at.ply.gg:38979

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

mayo21.duckdns.org:2815

Mutex

5be64674f6c

Attributes
  • reg_key

    5be64674f6c

  • splitter

    @!#&^%$

Extracted

Family

njrat

Version

0.7d

Botnet

hackpack

C2

cryptoban.ddns.net:7080

Mutex

614f5b9de3a2d1c0768b788aac77a023

Attributes
  • reg_key

    614f5b9de3a2d1c0768b788aac77a023

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

FRANSESCOTkyLjE2OC4wLjEwNwStrikStrik:NTU1Mg==

Mutex

0a12c200b51a3f61d5cce2fd62c96311

Attributes
  • reg_key

    0a12c200b51a3f61d5cce2fd62c96311

  • splitter

    |'|'|

Signatures

  • Detect Neshta payload 1 IoCs
  • Neshta family
  • Njrat family

Files

  • New folder.rar
    .rar
  • 0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 562715e04723d243f2655243ce07accadcc3fc89ad9267f40564865cc6f3e168.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 5fc24af49135266571b585ded69894aeb84a7ef4c1108f005e719f4711cb6a72.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6212534947a40f8276316d2c766695f2862e01c6734608f36713c852b56c045b.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6bbaa6a2c3169548a607bfeed0fe2f7562790c06d24ba54edb3376dbadb8a7cc.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 6fd84d8f93ed3a6b37c938b22ac46dbb81b3710fc4e612e78c275c2ce69af81b.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b23251e7900a7d6c067231ec4858e19d94a39d007c392a5805e89fcd1271fff.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8dbfa6809f9a52d74ffa5bb373c588da4dbeb0ae2c8769e7311610c53826f812.exe
    .exe windows x86

    76cdbf777494f5c49310ced09b70cdce


    Headers

    Imports

    Sections

  • 9bc60bcffca3e692680f9e12646c8bd3986aac735b3b68c014d7db485403915d.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • a5207f85519c9cafdaac78e7449401fe9c54491a4ff6b852e50472ad89845662.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • e8cb9768f1137a92fd51df077cb724b696602a45b139426cb35f4add8fa56880.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • fb014da9ca6b3a47dc1b6a41baa61a9625e78c19d608eefdb495cc0fa9653295.exe
    .exe windows x86


    Headers

    Sections