njrat | Virus[.]Win32[.]Yerg[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Virus.Win32.Yerg.zip
Size

16KB
MD5

074273d61b5bf706cf7a3ce9059d94aa
SHA1

1e84630c13f7be2fbce031215c0d40850f714a1f
SHA256

6cdde7b378558b46a7616865de524ea6c099c581c9a506ca6de7bdb03d0f5aba
SHA512

e8e525eacaca8df4b635539c77b0fab6871c41471263d4b1bec8ec668a80df51b2b257984912b438dc420f7f5fb8885b07ce24ed3609dda9626694378d1d58a5
SSDEEP

384:I4kK9sQ1XvHcDxSz8p6t/ARtizeVm8FMwX+/kYcm6pvaPdeJQEnlM7LW:IT/gvpSkWiiVm8uMSkF/pWHolM7K

Score

10^/10

problast njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

problast

C2

80.246.70.38:45

Mutex

2ab8c5833320728337fe88f537ae5d6c

Attributes

reg_key
2ab8c5833320728337fe88f537ae5d6c
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/better.bin

Files

Virus.Win32.Yerg.zip
.zip

Password: infected
better.bin
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ