njrat | 3657aed63847c2096cc00a5162ad139f_JaffaCakes118

General

Target
3657aed63847c2096cc00a5162ad139f_JaffaCakes118
Size 14KB
Sample240729-d59kea1eqj
SHA256 7e049f62f9a0b91f91b6b7fe818184b096b5af830ee0105a0c65fc090c63120d
MD5 3657aed63847c2096cc00a5162ad139f
SHA1 8312434baa023e05315552909ad122745921ed6a
SHA512 ed6180dd3a3d63315245b8f56640257683f05fa350a03d2e4a6f85a45338147277627a7d318c9dc04d846d72b8d98b2101119faea7fb3d2d4874010cb94c3442
SSDEEP 384:A6EMC2qi9W63C6lnMsppEuIbef7xxzL2cH1yRBldm:A6JLzlMQVag1+dm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mybot njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Mybot

C2

192.168.0.103:1604

Mutex

9ca5d83ba76d13c53d85666d9bacd2a2

Attributes

reg_key
9ca5d83ba76d13c53d85666d9bacd2a2
splitter
Y262SUCZ4UJJ

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/123.exe

File Explorer

3657aed63847c2096cc00a5162ad139f_JaffaCakes118

.rar 14KB
123.exe

.exe 31KB

3657aed63847c2096cc00a5162ad139f_JaffaCakes118

SHA256 7e049f62f9a0b91f91b6b7fe818184b096b5af830ee0105a0c65fc090c63120d
MD5 3657aed63847c2096cc00a5162ad139f
SHA1 8312434baa023e05315552909ad122745921ed6a
SHA512 ed6180dd3a3d63315245b8f56640257683f05fa350a03d2e4a6f85a45338147277627a7d318c9dc04d846d72b8d98b2101119faea7fb3d2d4874010cb94c3442
SSDEEP 384:A6EMC2qi9W63C6lnMsppEuIbef7xxzL2cH1yRBldm:A6JLzlMQVag1+dm
MD5 SHA1 SHA512 SSDEEP

123.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2f79f1c9d23001945e6e20c64598622742fe8d75200e9397420924a1782294e0
MD5 96adec53048fc702a6c20ff1ba1e328d
SHA1 9d295d72af4218404eb5bd1db77cd499e2b35a74
SHA512 fb340bc473a6b033b4d28343acf3ce85a3f099bed4f214b72df4e9c74ac1d5e85540a4f09afe6ec39e61982b8745059fac2b05fe332c592383da522f4e819e44
SSDEEP 768:rFMXZwpJbb2zxxO5oaqHhisfvaMQmIDUu0tiFNj:CkKZisfQVk6j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3657aed63847c2096cc00a5162ad139f_JaffaCakes118

123.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3657aed63847c2096cc00a5162ad139f_JaffaCakes118

123.exe

mscoree

dotnet