njrat | 682061b30d5c929bd31e5d23a1a736ead65f124d16732f4e3de2ea973daf0f66

General

Target

682061b30d5c929bd31e5d23a1a736ead65f124d16732f4e3de2ea973daf0f66
Size

16KB
MD5

c7bcc707254a6b8ba96251df125d90df
SHA1

a5fb15679cf07b7f7a0d1f4355e256183548d7fe
SHA256

682061b30d5c929bd31e5d23a1a736ead65f124d16732f4e3de2ea973daf0f66
SHA512

d49e43998fad1fc15c35cab164a5b877230285aec3e930e729945c42bff545c75d953ce560ef3fdd17f47cb614af4d5c847b4cf9d77e09d8642088503f340e83
SSDEEP

384:jTjUP8Cab0Mbvd4RLMdHLHGXj/4g7Eb64rFHf3tm67QC+p47s:HHJbvWV8rH454b6kpdmW7yt

Score

10^/10

max njrat

Family

njrat

Version

im523

Botnet

MAX

C2

0.tcp.eu.ngrok.io:13241

Mutex

0557bafb14c73fcc927e4c1c97522cd6

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/6339af085c42edefc5bff55a84c66e8945a567eb193cc29b497aeb0233d53e0f.exe

682061b30d5c929bd31e5d23a1a736ead65f124d16732f4e3de2ea973daf0f66
.zip

Password: infected
6339af085c42edefc5bff55a84c66e8945a567eb193cc29b497aeb0233d53e0f.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ