njrat | be210796e138898a9882b8cb3e18889b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be210796e138898a9882b8cb3e18889b
Size

21KB
MD5

be210796e138898a9882b8cb3e18889b
SHA1

9218287bb9039d1393eaeea448a94bbd3b49126b
SHA256

7b748fc23c854d95ff7697102c1df8475d23f9dbd8fe91be0664a1413c111926
SHA512

9d8f65d5344dfa04640139b94c926b2f3d6e9dde85b42986c35aca386f3b1550ef622615d5af4f6ba1e4f9ecfef7b19efce84c33a43e3d9098b0e0cc26274b5b
SSDEEP

384:gBV3awQfFsWGQlpHnmr2EwsoSY12tIcLKTYqnrDiSMEJCR/CUoK3aWzixv2:gD3a1XvvmwsZYctLdqcE6XoK1

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

192.168.0.105:5552

Mutex

f70fb178bb5319eadd8af8422e77f126

Attributes

reg_key
f70fb178bb5319eadd8af8422e77f126
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/z0rhack.exe

Files

be210796e138898a9882b8cb3e18889b
.rar
legit_byZEThack.cfg
rage_byKICJIOTA_(rage3).cfg
z0rhack.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ