njrat | ed064734a0bf02c905e63d64a495364b[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed064734a0bf02c905e63d64a495364b.bin
Size

10KB
MD5

1570e823fe9d1e7be1afe7d91d801516
SHA1

247d3e999441b21d70a256c6a4785091f662cba1
SHA256

8560cde25c24653f1163b11d95094d9f784b1d65120487ede724bba7309423d9
SHA512

1a5baddfa4140cbfbd18eaa73b7e29df828aecb7cdc031ad7e0db5a4b3b171866b31e67b881698d7110bb2a92b8ea8b8c5e6db2607c0d403b9175f432c3493b7
SSDEEP

192:6UPXKM2MSatVK6HtsXhfYs0wy07Cz1PbldoL0ipOzFSOfB4GkSEE:ZPXR2vatIXq1wyFz1zoDOzFGvS5

Score

10^/10

nyan cat njrat

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

resilencia2023.duckdns.org:2009

Mutex

8abd92e56969

Attributes

reg_key
8abd92e56969
splitter
@!#&^%$

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/544a4d7177ed4b85a9c9807fa396e07e3243e2e6c4ce2b0fe0f908d6ee37bdc9.exe

Files

ed064734a0bf02c905e63d64a495364b.bin
.zip

Password: infected
544a4d7177ed4b85a9c9807fa396e07e3243e2e6c4ce2b0fe0f908d6ee37bdc9.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ