njrat | 1f4b7d2f534977627fa2a529013a5b58[.]bin | Triage

Sharing

General

Target

1f4b7d2f534977627fa2a529013a5b58.bin
Size

16KB
MD5

f4249b37b464bc82eee43496d510647d
SHA1

ed0af47d40b5898e21d57dc05f00b242ea54ee55
SHA256

cd7cd1c14e2fc0a27c888f7583ae3eba63aae5c98e39cf3dd1548101376c1df6
SHA512

257366e6f2970417d22e4f58aa6fc75557c9f6d12b425f24aa66a1caf8c23abe6bebe4d71de843c6aa51123791f4aadb0d1f8c31d9f763d51d6691663d5c34bc
SSDEEP

384:59F1DxNE6gS8gZG8ELSwCiI0E09IDCPZxA64CuoAingWT:59HxN8nTnLSwCMxiCBi64KAc

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:10759

Mutex

661b6ea41f1ed0c4de944947a67f44a1

Attributes

reg_key
661b6ea41f1ed0c4de944947a67f44a1
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe

Files

1f4b7d2f534977627fa2a529013a5b58.bin
.zip

Password: infected
dfe9486e22f4ff0d0c02ec2b0db5c50ee4e3b1c5309f0a39043640e19bada517.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ