njrat | 64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118

General

Target
64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118
Size 14KB
Sample240521-1e17nsbb89
SHA256 0b12ff391a080d3b62c4ea0c2eba0a67eed8d26652c78a9f1654cb2e7213c20a
MD5 64d731b7bdbe7b1697fb1d97ca12505e
SHA1 82c98d771536d6207655afbce00fda763b9c362f
SHA512 e4e6361188e1e65e1621acd1b5a7ea1ac5a5a280ae3f07d1fb8804cd32caa538469d4dfa2e87f8b157d5a7bc248e8f7637e6a0627fdc1a55eb314ec10d5736c2
SSDEEP 384:/m0dWH0vos2ii8u+OjyzZc7BFzf+tjsQdHugSCJ5/ezd:RdWHNB+OjyOlFzcjsUugVod
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

q njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

q

C2

192.168.1.3:7777

Mutex

ad0e8fb502ecf928942daab540ba981e

Attributes

reg_key
ad0e8fb502ecf928942daab540ba981e
splitter
Y262SUCZ4UJJ

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CL.exe

File Explorer

64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118

.rar 14KB
CL.exe

.exe 31KB

64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118

SHA256 0b12ff391a080d3b62c4ea0c2eba0a67eed8d26652c78a9f1654cb2e7213c20a
MD5 64d731b7bdbe7b1697fb1d97ca12505e
SHA1 82c98d771536d6207655afbce00fda763b9c362f
SHA512 e4e6361188e1e65e1621acd1b5a7ea1ac5a5a280ae3f07d1fb8804cd32caa538469d4dfa2e87f8b157d5a7bc248e8f7637e6a0627fdc1a55eb314ec10d5736c2
SSDEEP 384:/m0dWH0vos2ii8u+OjyzZc7BFzf+tjsQdHugSCJ5/ezd:RdWHNB+OjyOlFzcjsUugVod
MD5 SHA1 SHA512 SSDEEP

CL.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 02879d94414bb75a4167bea440b3e538e13ddcb325a66d88404629afc83395dd
MD5 d7e87763288419fb13d503ebb46bfbf2
SHA1 54b7f3497b1ac1767fbe9f830e9feba03482518b
SHA512 6ccf406712260b1508347df04fc4e002f7572b04a974b203f0522132fa0051b1dc4e12710dba711cd54c3ee1e5bfa6b8f007ad214038c187c0eb924080fe7132
SSDEEP 768:+dQZlGFnf6zxV+Ny/kfxfbvCYoQmIDUu0ti0zGj:1Iq8bnoQVkej
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118

CL.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

64d731b7bdbe7b1697fb1d97ca12505e_JaffaCakes118

CL.exe

mscoree

dotnet