General

  • Target

    KiwiX.rar

  • Size

    8.7MB

  • MD5

    18c7c6bd63ce912bec328a1cc6e5cd17

  • SHA1

    eb6f7e91c11f061e15b91a0932ff33af8785969e

  • SHA256

    ee767937bff522f5b77d5b098a042361ee93d83401632a78e7e5bb4e81a0d5f8

  • SHA512

    ff6777b796d2cdaee691d0edd6c6986b89a9cb7103bb2b36b8a2a7aed43c2e92544154aa7a10a0f5d048b45fb460b6e0b0401a3500e28353dd6e5eacaef26709

  • SSDEEP

    196608:LegioLLz0r2daKeMda4tVMd8o/qt3hHdDZgtVRIcrSJrg:LpiWLzU2QCdaip3THdd/cr+rg

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Negr12341

C2

5.39.43.50:7137

Mutex

4c2c2aa09d1de2ca95775b0e6edad78e

Attributes
  • reg_key

    4c2c2aa09d1de2ca95775b0e6edad78e

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • KiwiX.rar
    .rar

    Password: 0

  • KiwiX/Exec.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/Inj.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0

    850ed9fffc9a75f2316a2b644c3389db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/Inj.exe
    .exe windows:4 windows x86 arch:x86

    Password: 0

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KiwiX/KiwKey.dll
    .dll regsvr32 windows:6 windows x64 arch:x64

    Password: 0

    6a5978d03665528ad707e90ec357d440


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • KiwiX/KiwPG.dll
    .dll windows:6 windows x64 arch:x64

    Password: 0


    Code Sign

    Headers

    Exports

    Sections

  • KiwiX/KiwiX.exe
    .exe windows:5 windows x86 arch:x86

    Password: 0

    cdf2338385bbf26ec9ce2289fc7f2d64


    Headers

    Imports

    Exports

    Sections