Overview

overview

10

Static

static

10

010df829b9...28.exe

windows7-x64

10

010df829b9...28.exe

windows10-2004-x64

10

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

1d730b2a86...84.exe

windows7-x64

7

1d730b2a86...84.exe

windows10-2004-x64

7

1f4559c246...c1.exe

windows7-x64

10

1f4559c246...c1.exe

windows10-2004-x64

10

265c128a8a...2f.exe

windows7-x64

10

265c128a8a...2f.exe

windows10-2004-x64

10

49432b3c21...b4.exe

windows7-x64

10

49432b3c21...b4.exe

windows10-2004-x64

10

54fa454476...b1.exe

windows7-x64

10

54fa454476...b1.exe

windows10-2004-x64

10

66e68902e9...68.exe

windows7-x64

10

66e68902e9...68.exe

windows10-2004-x64

10

820a177b58...5f.exe

windows7-x64

10

820a177b58...5f.exe

windows10-2004-x64

10

8d5514730f...d4.exe

windows7-x64

10

8d5514730f...d4.exe

windows10-2004-x64

10

93e14db4af...0c.exe

windows7-x64

10

93e14db4af...0c.exe

windows10-2004-x64

10

9770fde1f1...18.exe

windows7-x64

6

9770fde1f1...18.exe

windows10-2004-x64

6

App_Dev_Details.xlsm

windows7-x64

6

App_Dev_Details.xlsm

windows10-2004-x64

6

Celery.exe

windows7-x64

7

Celery.exe

windows10-2004-x64

7

a563257161...10.xls

windows7-x64

3

a563257161...10.xls

windows10-2004-x64

1

crss.exe

windows7-x64

7

crss.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

Errors

Reason
office: non-rc4 encrypted document not supported

General

  • Target

    C1DE15B5D043DD79DD267DD5F6D8F3EA9E15BC8A2AB63CB5FB4080CB4804C18E.zip

  • Size

    55.1MB

  • MD5

    83b282a78dab75e8feb0a332408407a3

  • SHA1

    9421a8b9491cde035c467356a943087fef4bd81b

  • SHA256

    c1de15b5d043dd79dd267dd5f6d8f3ea9e15bc8a2ab63cb5fb4080cb4804c18e

  • SHA512

    ee57318b7817c4e2bb3a71121bbe7a38360a4432299e767dcbe32e42b28e4a583da3be25f6abb32448dcdf1244b18d68faa4cb36ffae5d2a8b1f64c1ffa64ff8

  • SSDEEP

    1572864:nNrjp0CEcC1sPpLFIN8MkpKn/RMD7m6mn9Pd:nNrjfRrPpLFVKn/RMu6mnL

Score
10/10
ratpyinstalleruserdcratnjrat

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

user

C2

45.153.230.56:9898

Mutex

3a0dd73b340192b95fd3ddf9fa526aa7

Attributes
  • reg_key

    3a0dd73b340192b95fd3ddf9fa526aa7

  • splitter

    |'|'|

Signatures

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Dcrat family
    dcrat
  • Njrat family
    njrat
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

Files

  • C1DE15B5D043DD79DD267DD5F6D8F3EA9E15BC8A2AB63CB5FB4080CB4804C18E.zip
    .zip

    Password: infected

  • 010df829b95529730aa0840699e780b9176822dbefc24864ccc134a790043a28.exe
    .exe windows:6 windows x86 arch:x86

    Password: infected

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • 1.exe
    .exe windows:5 windows x64 arch:x64

    Password: infected

    357b59ff56f808887438b8bd8ad0eaa6


    Headers

    Imports

    Sections

  • 1d730b2a86c3c18be5d1fe22ee0fdd869d6ca4e01da70f53dd5722619a61b184.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    870b8e75c7190e202e9c6c81dff1040c


    Headers

    Imports

    Sections

  • 1f4559c2464e25078e6f0ae6b99990b6607c5adc0d631d43ba380ae7de51f0c1.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • 265c128a8a9421847dea2121ae5ce79efb601616c4fd060ff9863f4c2c498c2f.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • 49432b3c2186b051d35f09423075574cc82dbac403e5a69f311d4451a5a0e3b4.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    774b9ee29865bc65243d048a6e76d9ed


    Headers

    Imports

    Sections

  • 54fa4544762fb14d407756fad69201bfaccc8db821a94e63079531d556cddeb1.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    eaddeabe4dc2146d8bbc6de524b45db8


    Headers

    Imports

    Sections

  • 66e68902e968ac5c762b7d4950df70b2ef8125d38d6884ff9e37e72542e47b68.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    870b8e75c7190e202e9c6c81dff1040c


    Headers

    Imports

    Sections

  • 820a177b585f0a50c430e1b2ac66467cda0d96eb80b8e39ddf23079c8f2c685f.exe
    .exe windows:5 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • 8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 93e14db4af6b127444c9349f6c9162f4eebba4c220378be18d63f9951cb63b0c.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • 9770fde1f1e7fd98bedf06daa29c7451f52ad1719a0d606343846c73b34e8218.exe
    .exe windows:5 windows x86 arch:x86

    870b8e75c7190e202e9c6c81dff1040c


    Headers

    Imports

    Sections

  • App_Dev_Details.xlsm
    .xlsm office2007
  • Celery.exe
    .exe windows:5 windows x64 arch:x64

    1e92fd54d65284238a0e3b74b2715062


    Headers

    Imports

    Sections

  • a563257161e5c3947e4ea5669e1ef5eafbe67d5049816de47313ada6f299ac10.xlsx
    .xls .xlsx windows office2003
  • crss.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Headers

    Imports

    Sections

  • d63d0acb8e7bf8927fdd9e120504e9e748c62e67ff9939696f16be364450f2bf.js
  • eb45c05e8d629f18973a325ec2e42cce259c1a7fb0f518820af62fb249df8804.exe
    .exe windows:5 windows x86 arch:x86

    c4540f421523fe2dc591e50be5ad7d0b


    Headers

    Imports

    Sections

  • fa9ace1399679c06348f90db37646c738fc709406ede9367e02c18067c2c6081.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • file.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • tempmail.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections