Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    KiwiXV4.zip

  • Size

    10.0MB

  • MD5

    3a46a2a92ccf023b0149d791bc79899c

  • SHA1

    9844fe4ae19c282635b2c5cfc7106b42ff9a7146

  • SHA256

    014984b4b81ac3aee22523fc6a79030159f63a0f79ba6028dde7dd8795b1c325

  • SHA512

    533b927c8ed9d3ab85bb1b23df5302cdadb73fce6d0b8a9144e1a12aac6a38be1d72df335c66132d8fe73b4dfeb4a2826077a4c7ab44a0ba9f2c68941e444401

  • SSDEEP

    196608:Jpq1YworjyoToZAe+UhBa68CTPmGYla/E6QzfNhg5pyqf6BgAJB:/RworjLv/Uhs68kmGYWQfj2f8nB

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

having-jackson.gl.at.ply.gg:56522

Mutex

7c148ac38012fc3caa04b1bbe75feba0

Attributes
  • reg_key

    7c148ac38012fc3caa04b1bbe75feba0

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • KiwiXV4.zip
    .zip

    Password: 0

  • KiwiX(vira)/Exec.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX(vira)/Inj.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX(vira)/Inj.exe
    .exe windows:4 windows x86 arch:x86

    Password: 0

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KiwiX(vira)/KiwKey.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    Password: 0

    6a5978d03665528ad707e90ec357d440


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX(vira)/KiwPG.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0


    Code Sign

    Headers

    Exports

    Sections

  • KiwiX(vira)/KiwiX.exe
    .exe windows:5 windows x86 arch:x86

    Password: 0

    cdf2338385bbf26ec9ce2289fc7f2d64


    Headers

    Imports

    Exports

    Sections