njrat | 9842f29436cc3864d4c710da189b6bfb_JaffaCakes118

General

Target
9842f29436cc3864d4c710da189b6bfb_JaffaCakes118
Size 10KB
Sample240605-qfdsnahb39
SHA256 f88d3d02e2c73b014bda0ce6ddcb9443b777f92eac5434cec1a917068799587a
MD5 9842f29436cc3864d4c710da189b6bfb
SHA1 3522b99263d99c3f9235dcd72ea61a349d142247
SHA512 b6b52ed1e22c1f3e32eadc05cd34e95ce1672d86be6ce828ec7f30fe25752bf7810d9b4ef8225d17d8556b3b67ea8cc36507f828bfdba0cc49496a008064e7f3
SSDEEP 192:Q8/1C8Q0N8h1uFnEOyETPBDdnW9Y3fGX9nXDYlQx7lFfoNX9sEDCr6wrkivA:Q8/1C/0NSfoLHnW9Y3f2nXD7oNXeEY6R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

212683d986fb740ad6a40184df48e604

Attributes

reg_key
212683d986fb740ad6a40184df48e604
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Server.exe

File Explorer

9842f29436cc3864d4c710da189b6bfb_JaffaCakes118

.rar 10KB
Server.exe

.exe 23KB

9842f29436cc3864d4c710da189b6bfb_JaffaCakes118

SHA256 f88d3d02e2c73b014bda0ce6ddcb9443b777f92eac5434cec1a917068799587a
MD5 9842f29436cc3864d4c710da189b6bfb
SHA1 3522b99263d99c3f9235dcd72ea61a349d142247
SHA512 b6b52ed1e22c1f3e32eadc05cd34e95ce1672d86be6ce828ec7f30fe25752bf7810d9b4ef8225d17d8556b3b67ea8cc36507f828bfdba0cc49496a008064e7f3
SSDEEP 192:Q8/1C8Q0N8h1uFnEOyETPBDdnW9Y3fGX9nXDYlQx7lFfoNX9sEDCr6wrkivA:Q8/1C/0NSfoLHnW9Y3f2nXD7oNXeEY6R
MD5 SHA1 SHA512 SSDEEP

Server.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 82ae902abbcb4f72939129dd13305f647b2872669288aab7b78de1df1f4a05ba
MD5 7d20763ede7ac7d8e574c9a08fe7383e
SHA1 e9a4e9fa0710e8540da1e4d49af339cc064bfda8
SHA512 7ce9bfcdd68bd1a03c9eda573655959acfccdc9b01ad9bad2c9a0a50da55558e4d13840544521ad173317fe10c40bc5ba26fe28f76f1fd613c94accf844e6551
SSDEEP 384:H8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZbDlO:8Xcwt3tRpcnuSE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

9842f29436cc3864d4c710da189b6bfb_JaffaCakes118

Server.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

9842f29436cc3864d4c710da189b6bfb_JaffaCakes118

Server.exe

mscoree

dotnet