njrat | 93e12e74a8d5c47f02f1d11e2f952207[.]bin

General

Target
93e12e74a8d5c47f02f1d11e2f952207.bin
Size 10KB
Sample240122-c2d4nafaf4
SHA256 2be6f6a9d30ab9fa742e65cd40a567569be367b9478616a4c4a07b2173478ea9
MD5 5686447b6a892b6b8c47758b38a67cb1
SHA1 a9d4a2efe91757420d700ed0fa012a70201917fb
SHA512 3b6c53118ba92dbf0e4de8c6ac4426a544ac3357cde465cd07fbcc156436a4b96d31cc2a6d3979f51a397f9b9bfd384b80190fcbf7f1c80e147710db5abf4bab
SSDEEP 192:/qYAWr4OU17ptEt7InjjQ3QpwdSCvGSon0V1URbjFFjpkEhV4SG88:SYAW7U1NtaQjQ3QpwdXXcRjR5G88
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nyan cat njrat

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

20.201.119.163:1026

Mutex

f6d911a1527f4

Attributes

reg_key
f6d911a1527f4
splitter
@!#&^%$

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031.exe

File Explorer

93e12e74a8d5c47f02f1d11e2f952207.bin

.zip 10KB
59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031.exe

.exe 32KB

93e12e74a8d5c47f02f1d11e2f952207.bin

SHA256 2be6f6a9d30ab9fa742e65cd40a567569be367b9478616a4c4a07b2173478ea9
MD5 5686447b6a892b6b8c47758b38a67cb1
SHA1 a9d4a2efe91757420d700ed0fa012a70201917fb
SHA512 3b6c53118ba92dbf0e4de8c6ac4426a544ac3357cde465cd07fbcc156436a4b96d31cc2a6d3979f51a397f9b9bfd384b80190fcbf7f1c80e147710db5abf4bab
SSDEEP 192:/qYAWr4OU17ptEt7InjjQ3QpwdSCvGSon0V1URbjFFjpkEhV4SG88:SYAW7U1NtaQjQ3QpwdXXcRjR5G88
MD5 SHA1 SHA512 SSDEEP

Password

infected

59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031
MD5 93e12e74a8d5c47f02f1d11e2f952207
SHA1 cd145a98bfdf5ecde16b27dc8f3956235d6b4b3f
SHA512 ee3c072d290e11fcdf78fcebcb44fadeb3eadc99f3febabd0fc5d2032611aa00c0ae4e01c47ad299d65add2e00e3ffa66104a416429eede762ff830ab0b9582f
SSDEEP 384:t0bUe5XB4e0XmO3fw0Q0mS03AWTxtTUFQqzFYObbJ:+T9Bu1o55d2bJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

26462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

93e12e74a8d5c47f02f1d11e2f952207.bin

59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

93e12e74a8d5c47f02f1d11e2f952207.bin

59d681ed3c9edb0382a7fcd9ab62a78966ba532c21791a81f886db8808746031.exe

mscoree

dotnet