njrat | Payload[.]exe

Resubmissions

05/08/2023, 18:02

230805-wmx3rsdg79 10

04/08/2023, 15:17

230804-sn27bsda7t 10

Sharing

Copy URL Twitter E-mail

General

Target

Payload.exe
Size

27KB
MD5

78d1f15995b2d13269bfb0e4b8c2813d
SHA1

9850edaedec6535ea5d372c9cad2ac0cbb2126b8
SHA256

b32956179532d2d2440c713ea5f27b9cb20bb9a07c29762c8421bccf7b05242b
SHA512

61737b7c3f4479f0bde1c12c4e73929d9495d6f896477157ceea051cb96120aa314444fcd4e5ece60ff05db069a125ade70707da2a6d93fa9b2db62142a03336
SSDEEP

384:mL3kbV23m4AfVBol22CoP6udRNMpAQk93vmhm7UMKmIEecKdbXTzm9bVhcaj6JrZ:A3eJrgEpA/vMHTi9bD

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

amazon-engineers.gl.at.ply.gg:80

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Payload.exe

Files

Payload.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 25KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 576B

.reloc Size: 512B - Virtual size: 12B

.text
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 576B

.reloc
Size: 512B - Virtual size: 12B