njrat | aaf00b53df385ee3e4a34e3712ec0636[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aaf00b53df385ee3e4a34e3712ec0636.bin
Size

14KB
MD5

398e1337ee45b52b30232eacf411cc13
SHA1

58889bcca776b1030687aa800130e0fea1366acc
SHA256

31782746fa60a1b586c83611e297343ad27e7f37a9faf3937f44cdaa9e441dfd
SHA512

fe583a262205f8155fa067da191b1c2097e90f342a50a295709af1b4f966def5fbaae8ff6df46aba9e52e550f09089e3552fbfc0772845460b91355da99b23b8
SSDEEP

384:7nmLcCeK+66Fe5qBIHU8c/VCMixkdgQvuGs1nzTAZ5O0ig7+:7Ec65yeiI08c/wx6wTAZM7gi

Score

10^/10

mybot 2025 njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot 2025

C2

mznhr.ddns.net:4887

Mutex

5d33060b656af2b9a3ae52904371dccf

Attributes

reg_key
5d33060b656af2b9a3ae52904371dccf
splitter
Y262SUCZ4UJJ

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8be7871aecfc2e3039cefaeab9954a4ee7903ece4099bfa295936b030764f521.exe

Files

aaf00b53df385ee3e4a34e3712ec0636.bin
.zip

Password: infected
8be7871aecfc2e3039cefaeab9954a4ee7903ece4099bfa295936b030764f521.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 575B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ