njrat | 0849a04475313ded82b88d305bf5ea393beb00102a0b0cb09033b4c9f3a5b2cb

General

Target

0849a04475313ded82b88d305bf5ea393beb00102a0b0cb09033b4c9f3a5b2cb
Size

11KB
MD5

19f81551a48c4f8fc31a41a1c0854b67
SHA1

29cfd2fe6cb383d9eb00aa7bd6af306164449956
SHA256

0849a04475313ded82b88d305bf5ea393beb00102a0b0cb09033b4c9f3a5b2cb
SHA512

72741eaf0c8855af8b79c17e1d4dbf2736ec79152c328fb236f59fc6eab6fe295aa0563b565d6dd4908230a0e3b389894f0e7c80b7bc189bc321d01a959ff236
SSDEEP

192:Vp/3+rXOcxAZxjhJ9QwFTTSg82MXVibFPSfz13fEL+emy1oAbAvneiGgySePXau2:L/36+cAfX9QwFnU2OSSfTSoNne6uPXa5

Score

10^/10

njrat

Family

njrat

Version

PRIVATE

C2

127.0.0.1:3399

Mutex

165d6ed988ac

Attributes

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a78a8ba6bd378fceb61936aec9b0880fcc01a39e99452a87bf99b4e068af5d89

0849a04475313ded82b88d305bf5ea393beb00102a0b0cb09033b4c9f3a5b2cb
.zip

Password: infected
a78a8ba6bd378fceb61936aec9b0880fcc01a39e99452a87bf99b4e068af5d89
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ