njrat | 4df58d1e0318b860b6002563ad2fb299_JaffaCakes118

General

Target
4df58d1e0318b860b6002563ad2fb299_JaffaCakes118
Size 31KB
Sample240729-sfk8vayanh
SHA256 cef68d1cd109c354e59ee45e96421f0512d8738fffe4f86dbb0f096720bdd920
MD5 4df58d1e0318b860b6002563ad2fb299
SHA1 6c0935e7e5b20928f21f8d712ff87b700af45bae
SHA512 98c6d38e204b43179dc330aa9c6ad7d4251773835252a598061d04999bb4da16ab060f4f11dbade506c92a625930900c6cbc0a0ae6b0d7690dd52575be560e34
SSDEEP 384:7q9UqhVOZy+SKD7y7XHdPPYNuALhuCZQzwF5QDt17iqK0aGW2k0iOAmrRORFhQc5:7MOZy+SKfyz9ToQzwzQDQ2kNREBAteW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000
0.tcp.ngrok.io:17580

Mutex

bc9557cf26fd689e9d080fde21016d56

Attributes

reg_key
bc9557cf26fd689e9d080fde21016d56
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/me cheat.exe

File Explorer

4df58d1e0318b860b6002563ad2fb299_JaffaCakes118

.rar 31KB
me cheat.exe

.exe 93KB

4df58d1e0318b860b6002563ad2fb299_JaffaCakes118

SHA256 cef68d1cd109c354e59ee45e96421f0512d8738fffe4f86dbb0f096720bdd920
MD5 4df58d1e0318b860b6002563ad2fb299
SHA1 6c0935e7e5b20928f21f8d712ff87b700af45bae
SHA512 98c6d38e204b43179dc330aa9c6ad7d4251773835252a598061d04999bb4da16ab060f4f11dbade506c92a625930900c6cbc0a0ae6b0d7690dd52575be560e34
SSDEEP 384:7q9UqhVOZy+SKD7y7XHdPPYNuALhuCZQzwF5QDt17iqK0aGW2k0iOAmrRORFhQc5:7MOZy+SKfyz9ToQzwzQDQ2kNREBAteW
MD5 SHA1 SHA512 SSDEEP

me cheat.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 19bce8b43cec020363c5c2a4996b83a5b3516e3adc74111453b61b89559b8bce
MD5 9a719d36e0172250158473606358aa48
SHA1 fecc163c6278085f53edf87c211d0f20fe9e25dd
SHA512 e942910cc8725afd41f149116215025e04a1fee6c5a10ed5fe48f71fb63068ff63fbe782f5234bd50a52090831d23e0724b1e69e968dc6567e6b063b3f2daaf2
SSDEEP 768:KY33UfhWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3hsGdphgM:FU5WhIUKcuOJ2PhBjEwzGi1dDxDhgS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

102142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4df58d1e0318b860b6002563ad2fb299_JaffaCakes118

me cheat.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4df58d1e0318b860b6002563ad2fb299_JaffaCakes118

me cheat.exe

mscoree

dotnet