njrat | b3ce84c47a7387ae000f417d4c593979712be1e150fb718595670a1c3b2aee5a

General

Target

b3ce84c47a7387ae000f417d4c593979712be1e150fb718595670a1c3b2aee5a
Size

12KB
MD5

ae9dff6bf8a8daffc7705f1baa90dc34
SHA1

c5ca14bf8060fe4ec871486658d3b2bd8969d9f8
SHA256

b3ce84c47a7387ae000f417d4c593979712be1e150fb718595670a1c3b2aee5a
SHA512

a58d1fedf9c1f34b290b52d77f8332d1d6acfc6e990f5a36e40262a02e52058231a99a029d26f29bbae3aa63fb660e820ee80d659cddd15d1cc7c9e9243f12e2
SSDEEP

192:ozO00BAsUjjRKa7J2ggXtXe9mjmeL4PkLTM2HbWprWymlQZOEp56PcS86Pee2MMv:ozOjMMUwZji+c9InlQUM5VILS

Score

10^/10

Family

njrat

Version

v2.0

Botnet

XXXXXXX[1010]XXXXXX

C2

2525.libya2020.com.ly:2525

Mutex

Windows

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1e1c070a0f2d2545be43e14814124b18bb46f458fb7f66e51c6a6a426f8ad4da

b3ce84c47a7387ae000f417d4c593979712be1e150fb718595670a1c3b2aee5a
.zip

Password: infected
1e1c070a0f2d2545be43e14814124b18bb46f458fb7f66e51c6a6a426f8ad4da
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ