Overview

overview

10

Static

static

10

246ab25a72...53.exe

windows7-x64

10

246ab25a72...53.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853.exe

  • Size

    65KB

  • MD5

    2fb7fc0949aa14070e5e5d1ec37d48e7

  • SHA1

    9b0043790d9881f690e11086004d3218648d9c22

  • SHA256

    246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853

  • SHA512

    13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b

  • SSDEEP

    1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw

Score
10/10
hackednjrat

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:11964

Mutex

Exspa.exe

Attributes
  • reg_key

    Exspa.exe

  • splitter

    |Ghost|

Signatures

  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Njrat family
    njrat
  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections