njrat | 72d595eebef948926edcb8a6dd97c3b3[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72d595eebef948926edcb8a6dd97c3b3.bin
Size

1.4MB
MD5

7677905928e7241dad7afe38612987d9
SHA1

30dcae8e12c3d4b6a42b31510d0fccdfe90e116e
SHA256

b980b2d29d86a87ac7dbeefffc941c6147bbd1a5a80b3b8269d55e8bd0eb8a2c
SHA512

519a99be5ebebb7c6ab628021ef49a7682be860c76ce4ce36b87e255979f5e9f339489be7abb82480d6c5b9a1c804c907caa99f22de44ad33731046e122684eb
SSDEEP

24576:E9EeEXyj7uOkkeJN6OgV53/Ykm1x/MISwx32/KIFjFKcT06O0:EHEXqPFgN2X/Oqe3MBsQ0H0

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:15073

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2537fca11c35a9c8e7655513b53aefb88bddd133855fbb4b56b5e6b0ee206cb5.exe

Files

72d595eebef948926edcb8a6dd97c3b3.bin
.zip

Password: infected
2537fca11c35a9c8e7655513b53aefb88bddd133855fbb4b56b5e6b0ee206cb5.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ