njrat | d7a1823bb36f69895b293f51627bec5b480c8e30123b7d52c4be0498686a45c1[.]zip

General

Target

d7a1823bb36f69895b293f51627bec5b480c8e30123b7d52c4be0498686a45c1.zip
Size

16KB
MD5

16a3bd9fc66d2d18133b88f032bae09b
SHA1

f1fa9087e6dcd0a1b0bee088c9bfbb5afe43f57e
SHA256

04fdd9b26bf6c6a1d01753942af942212215391c6695ac6cadf507b996e3924e
SHA512

8e6469fe929fd52e2a5c5a282a7f8886634eec08d8173bbe741135422d5e7e0458d2b9e1f7d8cf4bd682eeb910a15e9d3633123bfc693c2d5e561a11d2d9d3d9
SSDEEP

384:hOLUJ0jE8CmNnQYH2XdgalsHtiilD6hOqilU3Tu8iJxu1pdb:hOoSjE6nQYHQdgaluiiJaOqilGiJOpdb

Score

10^/10

hacked njrat

Family

njrat

Version

im523

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:11170

Mutex

d6c30312a6155562fe32f9e3bad0f1a7

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d7a1823bb36f69895b293f51627bec5b480c8e30123b7d52c4be0498686a45c1.exe

d7a1823bb36f69895b293f51627bec5b480c8e30123b7d52c4be0498686a45c1.zip
.zip

Password: infected
d7a1823bb36f69895b293f51627bec5b480c8e30123b7d52c4be0498686a45c1.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ