General
-
Target
for virutotal ni.zip
-
Size
45KB
-
MD5
1a2368d23f8d860cdfc3ba6bb18536fa
-
SHA1
cda69dd2f3e6ef00adf3dceb7f403c95030376a7
-
SHA256
37882f4164207e92923b63e30c96fa762833603f0967f65102be70b605c631f3
-
SHA512
c030a4c906ed7bb9ae40c0b12f1c000225986fcd79b68f3c4a51eddc9b16614e37dc055ccd113ab598ebd0c37069eba81d52a74d1a40b01dfdf7a02a54fc1499
-
SSDEEP
768:8g/qN7Df5msVdlrz4XqaKScBdmFITsH9y4FtYs74yRybclk1gz/b75yB4PGyEvkB:rqh5tVvrk6icBd6EsdyjskGrlggv9yBY
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5OTA1NDUwMzg1Mjc3MzQ3OQ.Gam-5g.mMYt_UiACKf3lceb5vBDHE9GHZi685c16_84bo
-
server_id
1299046739898011668
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
farted
C2
127.0.0.1:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Discordrat family
-
Njrat family
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Files
-
for virutotal ni.zip
-
for virutotal ni/Client-built.exe
Headers
Sections
-
for virutotal ni/free robux.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections