njrat | 0c51f84b1af7a98e9b59e0b50c776794[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c51f84b1af7a98e9b59e0b50c776794.bin
Size

16KB
MD5

1c1f970feec6d43aa055cae4de0605d7
SHA1

3963864516bcc069f30b57680e88fb6029bf5ab9
SHA256

dd36c2f17eef92887da28541f48311e2bcfa328e9394de6db1a94fc28eb0a40e
SHA512

f8f12cc9ed99fb7e32385a8b3d5c5817520f44d242198ecefb174a043b0bdc7b301d8543fcec21f67084fdb62eb5d4772f74d391cc24a0b0a02dca1b9d26d878
SSDEEP

384:phcm4PEjUDoRgiLlSCtAiHwFlJ7srNDa9k8iQPBcUmmE2:pu7gUDomoHa77srNDD83pd/

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:13739

Mutex

2c40eeeff014857e08add3216939341d

Attributes

reg_key
2c40eeeff014857e08add3216939341d
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/82938e004b66e08eaa68cefb98eb52dae747e96763dce49b67041f25005dfd3f.exe

Files

0c51f84b1af7a98e9b59e0b50c776794.bin
.zip

Password: infected
82938e004b66e08eaa68cefb98eb52dae747e96763dce49b67041f25005dfd3f.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ