njrat | 20be24c90426c82034fafecbf1c96147[.]bin

General

Target
20be24c90426c82034fafecbf1c96147.bin
Size 17KB
Sample240615-bhq4fatdpc
SHA256 05800bdef0d7b8f44dc75059371f671307e96b3442739c0b13f528d4ae7e08d2
MD5 64506852f91e56b21960f4e6c33b09bc
SHA1 ed6a038983de8ca52362b7dbe6ee46cb99c2f0b7
SHA512 6091adf68448c956ecd12b9bc5aef8538a6462640d79d0443059b69fa622feeabc7308334d77567126fdea1e5560692db2edc0c55112b2367ae1947aaa654798
SSDEEP 384:TuX2+F805B1eaOkRjGwQK1FCyL1dGvUZbm2Pao5t/C:TJYIFKGWGiyoTC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:10942

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca.exe

File Explorer

20be24c90426c82034fafecbf1c96147.bin

.zip 17KB
80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca.exe

.exe 43KB

20be24c90426c82034fafecbf1c96147.bin

SHA256 05800bdef0d7b8f44dc75059371f671307e96b3442739c0b13f528d4ae7e08d2
MD5 64506852f91e56b21960f4e6c33b09bc
SHA1 ed6a038983de8ca52362b7dbe6ee46cb99c2f0b7
SHA512 6091adf68448c956ecd12b9bc5aef8538a6462640d79d0443059b69fa622feeabc7308334d77567126fdea1e5560692db2edc0c55112b2367ae1947aaa654798
SSDEEP 384:TuX2+F805B1eaOkRjGwQK1FCyL1dGvUZbm2Pao5t/C:TJYIFKGWGiyoTC
MD5 SHA1 SHA512 SSDEEP

Password

infected

80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca
MD5 20be24c90426c82034fafecbf1c96147
SHA1 c315c20c97014edd96074b2322461cc3eb324720
SHA512 797dfdbdefa9de5e966499b800a8a31c648207453ce7e1340c99c5feb6522d567db5a36c5de26e66848799abc86aeba9ae21e4b7dc6eb4d327c84c8c74888da2
SSDEEP 384:S8ZyCFgyCEFmVoyblVM38K0EBEzMghwzEIij+ZsNO3PlpJKkkjh/TzF7pWn2/grq:S6TFgyVAVlbb2fOQgQuXQ/oz/+L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

50062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

20be24c90426c82034fafecbf1c96147.bin

80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

20be24c90426c82034fafecbf1c96147.bin

80b7e96fc227f23824e4e964d2eedfb030fb4ca43e356d5602a8f65e838488ca.exe

mscoree

dotnet