Overview

overview

10

Static

static

10

2652-369-0...ry.exe

windows7-x64

2652-369-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2652-369-0x0000000000400000-0x000000000040C000-memory.dmp

  • Size

    48KB

  • MD5

    12648743e5be703ba718e4b5d94ee885

  • SHA1

    2c3619604793342fad88e4e83fff4650a7ed65e2

  • SHA256

    efdfa00f5944f6e7c9a01726df1313f227587cfb4b2b9bb79f894eb030bd9121

  • SHA512

    55fcbacade868cce76a583bcc6a67bfa2487e964b15bb81b18194f86a237d3fcbd705b0e796ecd1d81ff3152d21dd102d3227117af54569167576377bd4200a2

  • SSDEEP

    384:Yc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZzI:Me9EJLN/yRpcnuj

Score
10/10
neufnjrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2652-369-0x0000000000400000-0x000000000040C000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections