njrat | 0647d85ad26dd42f69aeae272251355a[.]bin | Triage

Sharing

General

Target

0647d85ad26dd42f69aeae272251355a.bin
Size

16KB
MD5

071385e7a63c4a2b2d013446f6e46dcc
SHA1

ac5467854ba97079e78ed28c8b416d744c4b25ad
SHA256

77b692233f1784d9f726a9329413e39c8859bc614edc410c2498d5a7c3ac0c64
SHA512

ebd6bc767b67bd8b99b6a3e04232b8a537e14043aac1a066dfd737919901533d3d82aac9031edfebc2b2ce5a3de638ee73d413114aa601500a29d95f90d518d9
SSDEEP

384:cHKxta538CjOlKPQg7CR/hQcjajm1XJc4HoEbdlW6Ih6Ig12CR03/eaE:wKxI53bOlKogm/hQcjaUm4Hp5lWN4J1l

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:13886

Mutex

1cfc3a4d79c70d0292d64e0bc7c3001d

Attributes

reg_key
1cfc3a4d79c70d0292d64e0bc7c3001d
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2.exe

Files

0647d85ad26dd42f69aeae272251355a.bin
.zip

Password: infected
620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ