njrat | cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4[.]exe[.]zip

General

Target

cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4.exe.zip
Size

11KB
MD5

8d7975d69125c1b029fa79cc576b46e2
SHA1

bb39ca1dc05d02bfd923efb3da3379fb006f4460
SHA256

5896d3a1280896db6b9080c536b19d9c3a27a9c87edccb522bf90ad6275e4fc3
SHA512

9955df9556c1ee204e76d6a052c6ea11169ff2bdc4031fec0e301a1c93afd04b6137ca634079e7cde97f5df37642227b55e8bc967abb1c04c114fe33ffc6d22b
SSDEEP

192:G3gymQXxW9PBcE0EoJTsDAvSUVejJJtHRX7Qssvh6gdLjxNrqdEFz7aN6SVSoWQM:Q9dxuPx0EopsYSUVe9LH6ssvh1xFNV71

Score

10^/10

hacked njrat

Family

njrat

Version

0.7d

Botnet

HacKed

C2

needforrat.hopto.org:7772

Mutex

47b887645f4457386c0b55e0a170685a

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4.exe

cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4.exe.zip
.zip

Password: infected
cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ