General
-
Target
Server.pe.exe
-
Size
37KB
-
MD5
acbd25ef5381687325d8065f95c2a4eb
-
SHA1
790fc998cf36f116223a9335eeb8a51642cec1d1
-
SHA256
713a45ab13e985955e505dd38465a96cf9da4353204ec1a919e13c387b251e8a
-
SHA512
16ae75933a9ea84966af56678765a805636d3d3550938a002fa2882e470f0aa94fff46b7a842bb3e1a4ee96ab7cdf6ee9687c1a5d6c67b6946ed065f0aa8e01d
-
SSDEEP
384:9+rMiLHBndznNCyMGmSu+uX35cBsIDRhrAF+rMRTyN/0L+EcoinblneHQM3epzXz:4HRNRMGmSuLZKsIdhrM+rMRa8NuCA7t
Score
10/10
Malware Config
Extracted
Family
njrat
Version
im523
Botnet
YourMother
C2
127.0.0.1:5552
Mutex
0a949395673c1d105dd63aca640a7dcd
Attributes
-
reg_key
0a949395673c1d105dd63aca640a7dcd
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Server.pe.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections