njrat | New Client[.]exe | Triage

Sharing

General

Target

New Client.exe
Size

167KB
MD5

52f7e0f8c498fa44afd01b72217ef7bd
SHA1

f9dff4b1b160c1587e82516e090cc8367938e24b
SHA256

989a644787020e3e9870161e2bdc55c3c7af68dda8b524e9e05ebc1d429614b9
SHA512

0e9e1365c437ded4259c84ee28278b1a0c750c75f75ab8f0a33b7c2f8bfc33eca906b84b58ecc93ca4d225fe84ffd00d4cc95372bdb1970f70a1be5cd150ccf0
SSDEEP

3072:Z6eOfoN36tLQviFCu9BnxpfWl9zgaF9bBYvM+UJ8T2SXZyrgoBJtbN/3MCK2kev0:ZMk9zwvMA/JdSI5eb

Score

10^/10

lox njrat

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

LOX

C2

127.0.0.1:16565

Mutex

Microsoft Edge

Attributes

reg_key
Microsoft Edge
splitter
|Ghost|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
New Client.exe

Files

New Client.exe
.exe windows:4 windows x86 arch:x86

Password: 312312

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ