njrat | 28afb35cde063e534e82bacfc0738869[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28afb35cde063e534e82bacfc0738869.bin
Size

16KB
MD5

df49e7d5c4360ff50f74a2092534f8dd
SHA1

c667c6874da10dbc742887ab848c59d846cfdb5c
SHA256

1ce576d8f717eb0b3f9398b74dbbc1dcd4168f3b664af9dcef9a0b3dd7f6d276
SHA512

cdfae69bfcfbff7123ccc856599716b99b0c897787befc7a3cb6ef4f43da687a475c957a1cc2fc2fe83ca4077979a1b92d370f9527d244578e33f5e48e06e24c
SSDEEP

384:M6KWL6CVxGGijLiWkARU0+nnnI3TH+V8f4Zo:M6X+DGWLiWkuQIDHqMb

Score

10^/10

soft2.2 njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

SOFT2.2

C2

7.tcp.eu.ngrok.io:18476

Mutex

21d02663aa8e611bb1da08e1c27cec11

Attributes

reg_key
21d02663aa8e611bb1da08e1c27cec11
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/92615b54debe2551cd8ef408dc573fdaf02f54e5a63b0b07c6b0f1edc43fda9c.exe

Files

28afb35cde063e534e82bacfc0738869.bin
.zip

Password: infected
92615b54debe2551cd8ef408dc573fdaf02f54e5a63b0b07c6b0f1edc43fda9c.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ