njrat | 2652-369-0x0000000000400000-0x000000000040C000-memory[.]dmp

General

Target
2652-369-0x0000000000400000-0x000000000040C000-memory.dmp
Size 48KB
Sample240806-kt9vcsveml
SHA256 efdfa00f5944f6e7c9a01726df1313f227587cfb4b2b9bb79f894eb030bd9121
MD5 12648743e5be703ba718e4b5d94ee885
SHA1 2c3619604793342fad88e4e83fff4650a7ed65e2
SHA512 55fcbacade868cce76a583bcc6a67bfa2487e964b15bb81b18194f86a237d3fcbd705b0e796ecd1d81ff3152d21dd102d3227117af54569167576377bd4200a2
SSDEEP 384:Yc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZzI:Me9EJLN/yRpcnuj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neuf njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2652-369-0x0000000000400000-0x000000000040C000-memory.dmp

File Explorer

2652-369-0x0000000000400000-0x000000000040C000-memory.dmp

.exe 48KB

2652-369-0x0000000000400000-0x000000000040C000-memory.dmp

SHA256 efdfa00f5944f6e7c9a01726df1313f227587cfb4b2b9bb79f894eb030bd9121
MD5 12648743e5be703ba718e4b5d94ee885
SHA1 2c3619604793342fad88e4e83fff4650a7ed65e2
SHA512 55fcbacade868cce76a583bcc6a67bfa2487e964b15bb81b18194f86a237d3fcbd705b0e796ecd1d81ff3152d21dd102d3227117af54569167576377bd4200a2
SSDEEP 384:Yc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZzI:Me9EJLN/yRpcnuj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1959886063

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing