njrat | file[.]exe

General

Target
file.exe
Size 43KB
Sample230609-bgmpmaaf36
SHA256 e7ae497afab39d1799e228532ded33ea74ec4a6bf8c79964a7d0f557c7264fb4
MD5 e33dafb811a56b8295d2cfb4cac645c1
SHA1 8d93eb10381a824464b4324a62735e4ec96393a4
SHA512 bdb7d514aaf37ae27bc0f8e5d098fd1bde97a7e7ca1c0d5388dcb5c592f07e6ace5470100492a87223414dada4bdcd0db1875744565d199b54efff2496aa0b4f
SSDEEP 384:rZy54oi98Na5yCSh1zWHjREYbul60kzsIij+ZsNO3PlpJKkkjh/TzF7pWnSSmgrq:FEiywwCQtg7WEuXQ/osC+L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

HowToLive913-31335.portmap.host:31335

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 43KB

file.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e7ae497afab39d1799e228532ded33ea74ec4a6bf8c79964a7d0f557c7264fb4
MD5 e33dafb811a56b8295d2cfb4cac645c1
SHA1 8d93eb10381a824464b4324a62735e4ec96393a4
SHA512 bdb7d514aaf37ae27bc0f8e5d098fd1bde97a7e7ca1c0d5388dcb5c592f07e6ace5470100492a87223414dada4bdcd0db1875744565d199b54efff2496aa0b4f
SSDEEP 384:rZy54oi98Na5yCSh1zWHjREYbul60kzsIij+ZsNO3PlpJKkkjh/TzF7pWnSSmgrq:FEiywwCQtg7WEuXQ/osC+L
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50126

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing