General

  • Target

    New Client.exe

  • Size

    65KB

  • MD5

    418617925234cf8529050924c905963c

  • SHA1

    d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91

  • SHA256

    6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8

  • SHA512

    e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415

  • SSDEEP

    1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL

Score
10/10

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:36811

Mutex

svhost.exe

Attributes
  • reg_key

    svhost.exe

  • splitter

    |Ghost|

Signatures

  • Njrat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • New Client.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections