General
-
Target
MailUpdate.exe
-
Size
93KB
-
MD5
9269b1758a4151f9b49c11967ac76628
-
SHA1
cdb7ede668e9f9b69950e29ca3e05b76daa1c0fc
-
SHA256
abfcae799cbe35f002f71a15bea7e666654effbaa3a736a472beb98addb09c2d
-
SHA512
0644e2fce92204f07172ecc7c36077784688c7c16cd97e121e8a0d3444c0c2507e765cb14b7421055731996de70de97785c518e60c3b4a2903bfc85496aefd32
-
SSDEEP
768:GY3m84BMPdPwchQW6aGro1CRaXPKG548gmKXxrjEtCdnl2pi1Rz4Rk3ssGdpZgS7:s8GMlP6aGrwCCX4ljEwzGi1dDEDZgS
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
SooN
C2
hakim32.ddns.net:2000
83.10.131.145:6666
Mutex
b0eaaca670b21e14c7e7fc8a3127b33d
Attributes
-
reg_key
b0eaaca670b21e14c7e7fc8a3127b33d
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
MailUpdate.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections