njrat | 8a40b60f37d095570a50f5edf2680d48[.]bin | Triage

Sharing

General

Target

8a40b60f37d095570a50f5edf2680d48.bin
Size

14KB
MD5

565284b6c3a8af44d7e18544c0ae5918
SHA1

fe0d7ef666be0a4fa17897f6d1b8bb9871c5817e
SHA256

f7bcb2b497f29e8403ab3766cf2f5d1421fb291e9216c69761938772a76368d6
SHA512

61582114958496c02f1ef3875adbd4ead65328e93a6bbe9876649d2e78a9ff0bfbe9917d9563f2433432e80855b553a39702accf93072057b5732240cba6237d
SSDEEP

384:Z32qerczaKsFpskt53IuwDlbp5oo7DKjU4dH:4qercWKsqkteNJjKQ4N

Score

10^/10

upss njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

upss

C2

0.tcp.eu.ngrok.io:14673

Mutex

4f7098563ca32e152a50bf8bea3737b3

Attributes

reg_key
4f7098563ca32e152a50bf8bea3737b3
splitter
Y262SUCZ4UJJ

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4c64981ad17309e21b795b0af8fc4174d4ebeaca4129ab73b50a37b96066daa3.exe

Files

8a40b60f37d095570a50f5edf2680d48.bin
.zip

Password: infected
4c64981ad17309e21b795b0af8fc4174d4ebeaca4129ab73b50a37b96066daa3.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ