njrat | 7699a1f8463d4e48b20d720f8f794dbc[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7699a1f8463d4e48b20d720f8f794dbc.bin
Size

10KB
MD5

1a111b08014a71d1f6b35121fb775884
SHA1

915c1948aefedeaaec186bd039ede4d7eb850c9f
SHA256

255f2b1570b878c789480c50fc7ad16c7526b3fe33dca8e087fc8af8d13e9bbf
SHA512

a07a1d7d91f8e2ed060fdaa07e38d3b56ab1a4d69bce09d5d972a4fe08404db9111249c6ddf3425eaaa8c8d4ef0ce15e6b1951c5190e1b798c46a62f485a3775
SSDEEP

192:5soCxADM99jEhiKynuKuoHhBOEOGdeo736edWfBsIP:5HhA9ZXIUhBOEtowqFBsIP

Score

10^/10

nyan cat njrat

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

patria.duckdns.org:1994

Mutex

8afb83f6665f4435b23

Attributes

reg_key
8afb83f6665f4435b23
splitter
@!#&^%$

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3f24a0243264894973daaddd665b311850024f99a47f935ca6ecba0d95f5f283.exe

Files

7699a1f8463d4e48b20d720f8f794dbc.bin
.zip

Password: infected
3f24a0243264894973daaddd665b311850024f99a47f935ca6ecba0d95f5f283.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ