General

  • Target

    1656-200-0x0000000000400000-0x000000000040C000-memory.dmp

  • Size

    48KB

  • MD5

    55798e4213da8764b28dfdfac9e937d4

  • SHA1

    1e367a84f0b8e3c935e456ceabe644f4576f7957

  • SHA256

    30e4907b5f7b76bb52afedb8e88f2cd245f7fac90e3cf6c4f9626b338ec94e82

  • SHA512

    4d6cd912ec81503ef200abea7aaca6bf1584e48d87a9273cab5e1639d34b9bf583fe8684c6512cdc6476f0116d72c29d3cd58ececf56421bff494067f180bee3

  • SSDEEP

    384:jc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZzI:pe9EJLN/yRpcnuj

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1656-200-0x0000000000400000-0x000000000040C000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections