njrat | 1234[.]rar

General

Target
1234.rar
Size 79KB
Sample240426-27bcdseh6w
SHA256 425694cddd39268f6754c47fbde45a08178979378d189a2ae689173f1fb2ffdc
MD5 dd019280bf93a2b8fb4ea3010869f036
SHA1 de944d30c7e102bc5792a7e9797c73ebfe1a7eb8
SHA512 0a03e15d147939cdc28bbb594d132d2d828f83e48eef9541e0ccd4ebe9b29d0378b47180f3b31a50bc63652ca135e0f4af2635d9e4c365dfa06a967af18c8564
SSDEEP 1536:Ej+hgSCkVYcom6kms32vDy7/3kClNdrmneG7zEvyV399mQ5AP3NFqnz:xhxCaLXX3/7fkeNVqzEKVuvPdwz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1234.exe

File Explorer

1234.rar

.rar 79KB
1234.exe

.exe 163KB

1234.rar

SHA256 425694cddd39268f6754c47fbde45a08178979378d189a2ae689173f1fb2ffdc
MD5 dd019280bf93a2b8fb4ea3010869f036
SHA1 de944d30c7e102bc5792a7e9797c73ebfe1a7eb8
SHA512 0a03e15d147939cdc28bbb594d132d2d828f83e48eef9541e0ccd4ebe9b29d0378b47180f3b31a50bc63652ca135e0f4af2635d9e4c365dfa06a967af18c8564
SSDEEP 1536:Ej+hgSCkVYcom6kms32vDy7/3kClNdrmneG7zEvyV399mQ5AP3NFqnz:xhxCaLXX3/7fkeNVqzEKVuvPdwz
MD5 SHA1 SHA512 SSDEEP

1234.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 000ba2f28d219e301f4cd78c20734a34b377241b5219dc0f8f31fc6b764a8940
MD5 f8a99a0f5c709d5a5c47614c45a6b036
SHA1 1205e89bad480e1445baa7e50c3efaa7bb85978c
SHA512 c3e2558f3abbb57435fcde0d123ed91303763906f43c7160ffbbd0584ffc9d1b2f3158cb2295e39b6f8ac2b676d508bdf8395dc5d423586ab23f3cd52fb17467
SSDEEP 3072:7dllu/Fcvsw0J6whe7X3wx7d0JkaEx/ZVD5b7D5g8Ynzk0Y:hls6wWHKd0WxxVVbhynzk0Y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

171758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

1234.rar

1234.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

1234.rar

1234.exe

mscoree

dotnet