Resubmissions

27-11-2024 08:07

241127-jzzqxa1rem 10

27-11-2024 08:00

241127-jv7wqavlh1 10

General

  • Target

    KiwiXV2.zip

  • Size

    1.9MB

  • MD5

    4092079f655b2c1f998485a1be4d95ff

  • SHA1

    ed2cd59eca0acc4f76673929200e1501f580e54d

  • SHA256

    d41d01815c6069b8b00bf76af27255bde4a42ad7da41ff37b7687246dcef4121

  • SHA512

    fa7bf35152c9144a6306a44409583b1590ec74eac51e6191b8533a9105efb1246685b0b142b8d52bc161d65867e274cf3a3782b6f1cd3ab2a6bf432de29ffbdc

  • SSDEEP

    49152:ckFEIeK74h3OdesV3tvdc3WUUxTGFfe8gwO:2IeK76Wesi3WLgFe86

Score
10/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Negr12341

C2

5.39.43.50:7137

Mutex

4c2c2aa09d1de2ca95775b0e6edad78e

Attributes
  • reg_key

    4c2c2aa09d1de2ca95775b0e6edad78e

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • KiwiXV2.zip
    .zip
  • KiwiXV2/KiwiXV2/CeleryScript.bin
  • KiwiXV2/KiwiXV2/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • KiwiXV2/KiwiXV2/Kiwi X.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KiwiXV2/KiwiXV2/Kiwi X.exe.config
  • KiwiXV2/KiwiXV2/Kiwi X.pdb
  • KiwiXV2/KiwiXV2/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • KiwiXV2/KiwiXV2/Newtonsoft.Json.xml
    .xml
  • KiwiXV2/KiwiXV2/Scripts/nigger.txt
  • KiwiXV2/KiwiXV2/bin/api/CeleryIn.bin
    .dll windows:6 windows x64 arch:x64

    57127fa98e84d836ff1e07fcec0c9958


    Headers

    Imports

    Exports

    Sections

  • KiwiXV2/KiwiXV2/bin/api/Inj.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KiwiXV2/KiwiXV2/bin/api/Inj2.exe
    .exe windows:6 windows x64 arch:x64

    314d948163c00dd9f09575a84339c9a6


    Headers

    Imports

    Sections

  • KiwiXV2/KiwiXV2/ccapi.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections