General

  • Target

    KiwiX.rar

  • Size

    8.7MB

  • MD5

    0557118dcf64b4d90d6f9fc9ab62845f

  • SHA1

    89e3d91d196c4bcd8744eb2bd41ddcdef04e15e4

  • SHA256

    fe6fcbfebd980a2529fd89b9bf50455ebe5c29c9f8a97eaf0820d0b7fee93ea8

  • SHA512

    d3f3b0692c503a0035225d0bdfea62d74d108ead6658a8a2df486645afe4946fd62a61bf2e4c3177a470a07c51c386cbc9b93b6944167f424c0209bce7d2994f

  • SSDEEP

    196608:d4BBgtFETq1kmhrbMQoAgvca31PFvJBPMVCM3Z+LCcn4Kk5+/tTCepT:OzMFvkCMQoiaFNxBPMIMpLHeC2T

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

5.39.43.50:6136

Mutex

d271327da5c8f1b61f30b7e19888f56c

Attributes
  • reg_key

    d271327da5c8f1b61f30b7e19888f56c

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • KiwiX.rar
    .rar

    Password: 0

  • KiwiX/Exec.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/Inj.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/Inj.exe
    .exe windows:4 windows x86 arch:x86

    Password: 0

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KiwiX/KiwKey.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    Password: 0

    6a5978d03665528ad707e90ec357d440


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/KiwPG.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0


    Code Sign

    Headers

    Exports

    Sections

  • KiwiX/KiwiX.exe
    .exe windows:5 windows x86 arch:x86

    Password: 0

    cdf2338385bbf26ec9ce2289fc7f2d64


    Headers

    Imports

    Exports

    Sections