njrat | njengie[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

njengie.exe
Size

165KB
MD5

5b2b7af8bf5c8a7d53629d8585f53627
SHA1

b3714a00cc9e07c35397f1554b54813e26d3573c
SHA256

557f2af4d3831b4e5f65ca81057c5cad10158caeea768f377b5da07c64facf2d
SHA512

36ec92110e26c4c0248e01bf8a850ab0c63944696b2d31ae08a52b6a845de1e7deb1be3388888295bb71c68519b29a1c6a257e0eaaf250d152a6eda2159078a0
SSDEEP

3072:jII2/5svEQKje6mEInRtvAjsXFHS+adymDaEvjZBJ0b93V4UFt9:jI3FmEIRtvAIXFy+asmDZLnWbok9

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
njengie.exe

Files

njengie.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ