Overview

overview

10

Static

static

10

Haerm.exe

windows7-x64

8

Haerm.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Haerm.exe

  • Size

    150KB

  • MD5

    09be5e4bf3662aed7dad54f028077c2a

  • SHA1

    f69a0b426c07299b1cfdce39396e4f458829cf91

  • SHA256

    431fd29552ea2ff3ade5f1c8c2c4e0b3d0eda33164a4487c4bc9174bc6bd4a44

  • SHA512

    08a5889c15ffc54d52eefc514a4c61637642d39d601c340938405b46d1f82fd1b3927022410e9637789fa4f422adaa2fffe99e65f19e51469f9c729a46dba2d0

  • SSDEEP

    1536:OXmVapektaqo+gRJNYY7Rbc4NPXJ5oPteAHm0If:OX+aEktw+yJqY7Rbc4NPXJ5oPteP0I

Score
10/10
svhostnjrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Svhost

C2

7.tcp.eu.ngrok.io:5552

Mutex

4126a9a7c6ea8e963fe61d1c5ed95467

Attributes
  • reg_key

    4126a9a7c6ea8e963fe61d1c5ed95467

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Haerm.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections