Resubmissions

14-10-2024 14:49

241014-r67zvsvaqq 10

16-08-2024 15:07

240816-sheh3svenq 10

16-08-2024 14:46

240816-r5jkwazgpa 10

General

  • Target

    GangBeasts.exe

  • Size

    7.6MB

  • MD5

    25ca0c07fa5e3b2fc1a30e5419a13c17

  • SHA1

    0231b575d2f96de4a9f510b081e5f519c5bafabd

  • SHA256

    a5ef976d928a096d7e298343b16ba54632411dc7fcb97f93e229ea24702578db

  • SHA512

    d7d87ab9dd41c97289f94dfeb6141972c101942a0a466c5f1eda581b5ef81c5c9666bbd518bcb6db80d5ccbbc03db27c55a53cd1fd10845d89d49391d9bf91ab

  • SSDEEP

    196608:n0+R+YMhI/tizvNSE28tpobqjglbxvb65j0iQtgcN+QiP1eggYej0WALg:n0+R+YMhI/tizvN88tpo28lFvWp0i2Zv

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

C2

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes
  • reg_key

    a8c0d4cf5cfc2cc1149b5e071c2ab5df

  • splitter

    |'|'|

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Njrat family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • GangBeasts.exe
    .exe windows:4 windows x86 arch:x86

    29b61e5a552b3a9bc00953de1c93be41


    Headers

    Imports

    Sections

  • Built.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • �8M���.pyc
  • Gang Beasts.exe
    .exe windows:6 windows x64 arch:x64

    5f74a5c747508e2822fdb9b687deaf42


    Headers

    Imports

    Exports

    Sections

  • kosomk.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections