njrat | sniif[.]Scr | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sniif.Scr
Size

816KB
MD5

307e9f20e28312dc72fcef348272b97d
SHA1

64c755cc253d2bd8db2aeb9968070a3150625a45
SHA256

94bc5f862a6a4b71ba591c3ab18bb08ea68907cd28667659e107d9c8c8e41b28
SHA512

cbef748a6e406e2203f7d05d1eef140a84541520c21d816cf8b75171a79de60655e19be3c4c199f05e4c9c520e878f0e4e33adfe91cb8dbd99e1655b2406ba12
SSDEEP

3072:I1QYi9bcppwFZaa38xU7LPs30r6/R6aEmay8VU7LPs30r6/R6aEPU6LgXH:Lj9bcza38xoCay8Vo7Up

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sniif.Scr

Files

sniif.Scr
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 784KB - Virtual size: 782KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ