njrat | 6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8[.]exe[.]zip

General

Target

6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8.exe.zip
Size

17KB
MD5

c963e48bd81690dd2bc1500eb1a75984
SHA1

384813ddb71612cd2b3dd3333be11d7c212b8dde
SHA256

033589717a025be5da53732fd7537cf6b2071d6e299af9d8f6aa80339be4ac8b
SHA512

63beb77fda000ca9d5c120cf62201daa907dc93714f6c808b19f8ce223d0a2e305b0ae0c1549ff05e57bc62001af29b6ab3c383e68af74e090c3c346db5351fa
SSDEEP

384:ucIozAMZGZlzcU0Et92NMphz4UuL//tTos94eFjTeiqS2WJV5SV:/ZGZlgtEt9FpPuL//ysLdgC5SV

Score

10^/10

scammer njrat

Family

njrat

Version

im523

Botnet

scammer

C2

topics-junior.at.ply.gg:45283

Mutex

87fbb7d05011dd3c6b564f136007bf19

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8.exe

6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8.exe.zip
.zip

Password: infected
6a65ffab90209b9a5fad0523b2878228f7062afc4679742d1efa0e77f419a8d8.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ