njrat | 8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118

General

Target
8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118
Size 72KB
Sample240531-trclhsed78
SHA256 280fddec307e254eeec3dbdde416cdeb4dcb1bf3109a831c53a187416edee434
MD5 8799faa67ea6a57c575d4981c0141d4e
SHA1 dcb69fac36507cd56c6b39e0e9d938d360d5632e
SHA512 de4480b3e2442e2619628f7810a18b62fceaf2777adafe0d1a0359326b861497db72a722650159b10df88c11cd00f61bb98868994af55753df22a3f3e0f30bc6
SSDEEP 1536:Ex+QkioPe/OJmOkSZ68vo/1qQNmvQ0lnanB4vUT5aH4Id2+:EQVe/OJTkS9y1yQ0lnanB4u84Id2+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

212683d986fb740ad6a40184df48e604

Attributes

reg_key
212683d986fb740ad6a40184df48e604
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Server.exe

File Explorer

8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118

.rar 72KB
13081890_253402641714096_558499780_n.jpg

.jpg 62KB
Server.exe

.exe 23KB

8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118

SHA256 280fddec307e254eeec3dbdde416cdeb4dcb1bf3109a831c53a187416edee434
MD5 8799faa67ea6a57c575d4981c0141d4e
SHA1 dcb69fac36507cd56c6b39e0e9d938d360d5632e
SHA512 de4480b3e2442e2619628f7810a18b62fceaf2777adafe0d1a0359326b861497db72a722650159b10df88c11cd00f61bb98868994af55753df22a3f3e0f30bc6
SSDEEP 1536:Ex+QkioPe/OJmOkSZ68vo/1qQNmvQ0lnanB4vUT5aH4Id2+:EQVe/OJTkS9y1yQ0lnanB4u84Id2+
MD5 SHA1 SHA512 SSDEEP

Server.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9c994437d4b772f582a23b71aa0450c9757f21d795e94f6615554a0c509df5c9
MD5 63bf598091ec7d9dfa446075842e7d19
SHA1 c21408023315cecbe6117890175a5becdc376753
SHA512 3ec91c96577281daa1f655a2c58b7915830c5e0ee2b226c04707d31e25aa3de67a01dae9c9168fe2300e33b33baac07e327dcd02535295cb96a47da3ff6f2576
SSDEEP 384:f8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZbDlx:EXcwt3tRpcnuSn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118

13081890_253402641714096_558499780_n.jpg

Server.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8799faa67ea6a57c575d4981c0141d4e_JaffaCakes118

13081890_253402641714096_558499780_n.jpg

Server.exe

mscoree

dotnet