njrat | porno[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
porno.exe
Size 68KB
Sample240617-xranpszgla
SHA256 f57af4ba15ac700989e7253dbb189c3dbeb3bd42d2287d4c4e1fe64facde5b26
MD5 e4bae86ddc6666a4115f3e7610ce4af0
SHA1 8eaaea1dd100b8e43aa9cebd977f94ae7731e6fe
SHA512 717d9e918211d7ecce04c73fc6b2ea1ab652a1074786dd8f9874afdb720d3cb05965fdbffa686898b0c393a9b7f043be017c5f57fe60308026a46f9c5b395406
SSDEEP 1536:A8GmIoN36tEQviFw1YcQQBnvbjfLteF3nLrB9z3nMaF9buS9vMe:A8GmIoN36tEQviFC7xBnHfWl9z8aF9b+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lox njrat

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

LOX

C2

127.0.0.1:17233

Mutex

svchost.exe

Attributes

reg_key
svchost.exe
splitter
|Ghost|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
porno.exe

File Explorer

porno.exe

.exe 68KB

porno.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f57af4ba15ac700989e7253dbb189c3dbeb3bd42d2287d4c4e1fe64facde5b26
MD5 e4bae86ddc6666a4115f3e7610ce4af0
SHA1 8eaaea1dd100b8e43aa9cebd977f94ae7731e6fe
SHA512 717d9e918211d7ecce04c73fc6b2ea1ab652a1074786dd8f9874afdb720d3cb05965fdbffa686898b0c393a9b7f043be017c5f57fe60308026a46f9c5b395406
SSDEEP 1536:A8GmIoN36tEQviFw1YcQQBnvbjfLteF3nLrB9z3nMaF9buS9vMe:A8GmIoN36tEQviFC7xBnHfWl9z8aF9b+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1

Minor OS version

0

Major OS version

4

Entry point

72750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths