njrat | a5dc8f26c798e69286e119ec60820fc93ce1feb5946534b32f57e44ca4fd4d77

General

Target

a5dc8f26c798e69286e119ec60820fc93ce1feb5946534b32f57e44ca4fd4d77
Size

12KB
MD5

faa51de536a95d421c8ff881ee20382e
SHA1

fdf5a29681bb2c7ff4997a55a52f34c91a1b8826
SHA256

a5dc8f26c798e69286e119ec60820fc93ce1feb5946534b32f57e44ca4fd4d77
SHA512

098fa3b18e56f68d78351154ca3cee58607a309bb23fdcb1845479c010456648cd670dd120855d54551493d86c685f7679344b4165e81a4b485ec7cd8f2af207
SSDEEP

384:8c0yGxiEOmV03Pdqeh+aZ/f2yY/qVKxsBDZWPUYFgv+WIQ:8ryG/md0gvUxsBDZWsX2O

Score

10^/10

webmail njrat

Family

njrat

Version

v2.0

Botnet

WEBMAIL

C2

2525.libya2020.com.ly:2525

Mutex

Windows

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cf3fa450ee6a5df68a822168aa6b8abc408aa99291bfe2f38fe756e7e2483a5f

a5dc8f26c798e69286e119ec60820fc93ce1feb5946534b32f57e44ca4fd4d77
.zip

Password: infected
cf3fa450ee6a5df68a822168aa6b8abc408aa99291bfe2f38fe756e7e2483a5f
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ