Overview

overview

10

Static

static

10

c56f7b9947...f3.exe

windows7-x64

8

c56f7b9947...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08b26b1bd71c6db9358c52230f0a87e2.bin

  • Size

    11KB

  • MD5

    9c1a9f3ee3041a7276d1eb29b192a5a2

  • SHA1

    2c418a378b450d8274bdf4b524240634fa1522af

  • SHA256

    856f6f22459ab35ebafb4f12c6a3aa3e8252170ab9fe06595cbd2985d96c3783

  • SHA512

    b1d928bf7e316e5e537c6397b853c1efa11c5659705c3d3a5236d83fec9a35835a0f00fd81feb71c83230fe96ca3b550c4ee3174a33afd23716980b18b1564cd

  • SSDEEP

    192:h1q+6X5gZX8b2webOFuqfTUswSsJ3m/+39GK5+2kEY//cCzCwSHzuBlvb3i3O4PB:nkvRexG/wd/pg2e/cYCwkuBtjOl7FGuT

Score
10/10
hacked by code wcnjrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKED BY CODE WC

C2

laczin.duckdns.org:1177

Mutex

cc9fd5186c368372a70d5ebb96c720c0

Attributes
  • reg_key

    cc9fd5186c368372a70d5ebb96c720c0

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 08b26b1bd71c6db9358c52230f0a87e2.bin
    .zip

    Password: infected

  • c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections