njrat | client_receiver[.]exe | Triage

Sharing

General

Target

client_receiver.exe
Size

164KB
MD5

04c297c98ba9d075e23d2de3076f9c5d
SHA1

6e2820c9c051b2c5a49a8075dca65f07fcb27e68
SHA256

a5ee70485c2d9ea112315f680da29b021af0f59d9e24e5533235262fb443ffca
SHA512

b9f9edbd9760ea1ccf3a6cfedb390ec11639144a48815c14da6475c43cbea8f007f2c8c409b9ab9a9d174da1308a5bacaee759e28d17fd0f5d69f023f3cdb5b8
SSDEEP

3072:O4CLB/XxvdUr+lmFdRVYizzSTx7Szynehu8rEaSjYreb17BbCiAzEsxPH:3C7ludRVYi0BSznh0agYKblBOZzEAP

Score

10^/10

njrat

Malware Config

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client_receiver.exe

Files

client_receiver.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ