Overview

overview

10

Static

static

10

1728-14-0x...ry.exe

windows7-x64

10

1728-14-0x...ry.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1728-14-0x0000000000950000-0x0000000000CC4000-memory.dmp

  • Size

    3.5MB

  • MD5

    f5e4136a654e56756591aee4431688e2

  • SHA1

    df26c2793bf0c2536f006cf5dbfd0331d4627478

  • SHA256

    93dabc5dcba6c87e164ae21f80c4d8896554777ebcf29644f28b0caef665c1cf

  • SHA512

    f9da803ac1015077182b97d1f9c74d2eb5e9dd0a1a509996cbab04e6774bd23c7e712e95381982e122b74e47e2bc5637f5ac1a7b66beafc0cd2f705d3928325c

  • SSDEEP

    49152:d/hfFXzMGDKZQMFcT6Iz5TxyhmdJIHMb4NnlgiTJUvb5i0x3T:dpFXzMGTUHI9xyfsbslgaJybB

Score
10/10
2njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

2

C2

than-electoral.gl.at.ply.gg:36364

Mutex

0c8d792f9c21b154330684f6c50ab800

Attributes
  • reg_key

    0c8d792f9c21b154330684f6c50ab800

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1728-14-0x0000000000950000-0x0000000000CC4000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections