njrat | NewClient[.]exe | Triage

Sharing

General

Target

NewClient.exe
Size

164KB
MD5

8f91ff6424f45a8e627d4c0f138ea57a
SHA1

9af628c435fa387b0b1d486a8239409ae42be227
SHA256

2b3612eb432f0d386b66282d33cf4632b9046aa2772bad8ba7289740d9fbeada
SHA512

7fd62d99f5dbe21c423ae389cda07a5ae98e17e805d0a66ed22404cf0efb356fdd04b7519f758a470576c6991f4e53881645f38c6fb1a04d7b1b5a1becded308
SSDEEP

3072:DibL/dEmP0If8IbsS31NPIuChLdEu9qcxkbGjMMOQvgBJt93:DiYJgQuChKUqBb/MbSJP3

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NewClient.exe

Files

NewClient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ