Overview

overview

10

Static

static

10

InjectIcon.dll

windows7-x64

InjectIcon.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows7-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

NjRat 0.7D...us.exe

windows7-x64

10

NjRat 0.7D...us.exe

windows10-2004-x64

10

Plugin/Ant...ss.exe

windows7-x64

7

Plugin/Ant...ss.exe

windows10-2004-x64

7

Plugin/cam.dll

windows7-x64

3

Plugin/cam.dll

windows10-2004-x64

3

Plugin/ch.dll

windows7-x64

3

Plugin/ch.dll

windows10-2004-x64

3

Plugin/mic.dll

windows7-x64

1

Plugin/mic.dll

windows10-2004-x64

1

Plugin/plg.dll

windows7-x64

3

Plugin/plg.dll

windows10-2004-x64

3

Plugin/pw.dll

windows7-x64

3

Plugin/pw.dll

windows10-2004-x64

3

Plugin/sc2.dll

windows7-x64

1

Plugin/sc2.dll

windows10-2004-x64

1

WinMM.Net.dll

windows7-x64

1

WinMM.Net.dll

windows10-2004-x64

1

stubs/Anti.exe

windows7-x64

3

stubs/Anti.exe

windows10-2004-x64

3

stubs/Stub.exe

windows7-x64

10

stubs/Stub.exe

windows10-2004-x64

10

stubs/dlen...nt.exe

windows7-x64

3

stubs/dlen...nt.exe

windows10-2004-x64

3

stubs/dlnormal.exe

windows7-x64

1

stubs/dlnormal.exe

windows10-2004-x64

1

stubs/mpress.exe

windows7-x64

1

stubs/mpress.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Njrat 0.7d PASS( 777 ).rar

  • Size

    1.9MB

  • MD5

    80c1fb0c86898658d850af1462eebdfc

  • SHA1

    ae2b606ce489b6a4c6e15ffd3ed3ce9c0094953c

  • SHA256

    1b0717bb1a92dbdc992dfd8958c2ba4d4db22b056a728ee1bdd06b9eb9d93be2

  • SHA512

    c1c655d5b055eb80f9554c5f9f7df008b0c8856669e80516ca6d44c742ea2c23ed64e65577eb68912c521f1c79de3c0375990853a64c988f7b3cbb208ae85b32

  • SSDEEP

    49152:KIRS9vT+F6EmLekZh86xwu1ETCFi4IegtHbp6:rS+F6Tiehiu1Zt4s

Score
10/10
upxloldarkcometnjrat

Malware Config

Extracted

Family

darkcomet

Botnet

lol

C2

dcplusplus.ddns.net:1604

Mutex

DC_MUTEX-TS69B03

Attributes
  • InstallPath

    startup.exe

  • gencode

    RAe9JPzTc6ht

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicrosoftUpdate

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

C2

:

Mutex

[RNVD]

Attributes
  • reg_key

    [RNVD]

  • splitter

    |Hassan|

Signatures

  • Darkcomet family
    darkcomet
  • Njrat family
    njrat
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

Files

  • Njrat 0.7d PASS( 777 ).rar
    .rar

    Password: 777

  • GeoIP.dat
  • InjectIcon.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Mono.Cecil.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • NjRat 0.7D Golden Edition - Rus.exe
    .exe windows:4 windows x86 arch:x86

    Password: 777


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Plugin/AntiProcess.dll
    .exe windows:4 windows x86 arch:x86

    Password: 777

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/cam.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/ch.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/mic.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/plg.dll
    .dll windows:4 windows x86 arch:x86

    Password: 777

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/pw.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/sc2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WinMM.Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • stubs/Anti.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stubs/Bsod.egg
  • stubs/Exe.egg
  • stubs/Hide.egg
  • stubs/Mpress.egg
  • stubs/ReGKey.egg
  • stubs/Sound/Sound.wav
  • stubs/Stub.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stubs/VN.egg
  • stubs/copy.egg
  • stubs/dir.egg
  • stubs/dlentrypoint.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stubs/dlnormal.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stubs/host.egg
  • stubs/mpress.exe
    .exe windows:4 windows x86 arch:x86

    51e7ef6b1d43d0d05d7109dee9789560


    Headers

    Imports

    Sections

  • stubs/regch.egg
  • stubs/regname.egg
  • stubs/startupch.egg
  • stubs/startupname.egg
  • stubs/task.egg