njrat | rat[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rat.exe
Size

36KB
MD5

94fa8aba1c43441715b82e8053b23bd3
SHA1

8d1263f2eef95bcc9f89135b45355152515ae2ab
SHA256

b31a0b479d4b9ac138d26153061835241b64a0ab42a2558013d7860466985399
SHA512

e4f945297eff60f0e2cefc44c8580e0fb6dfbb1b247e3e2ba7202ed97459dd992d2ce198594db2161fc60df2fc9f2f11e3282dc0b9576b7606bf052a4c4d0e38
SSDEEP

768:FiSKEob9aHTDnfUsLCUmKv0ntEhq5lxOBcmZPtwkjC:FiSKhbUHnfUsuU7vK5lxOWmYB

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

Files

rat.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ