General

  • Target

    Neverluse2.zip

  • Size

    11.9MB

  • MD5

    4a8ca7f758c5b8429f2c7bbfc6ba33a4

  • SHA1

    f5d238a837c5d9ae2faaae09c01b90abd7a6753d

  • SHA256

    a1c489cce0663f3ec6b057a16f951d455b04458553803b07dd356ea4e3ccba2f

  • SHA512

    726f03f77d77716d56493594a9d59a0e5e2d76cd1434eb2a7d279f35b26f7056b930bf86532b147fbfcefec612c727d04e17f81f5256fb567341bfe205550e32

  • SSDEEP

    196608:Ti+e553UgECAf+VLyHIZKpMKMXKhIIrAH87shgx4G+1yOAvQ1pn0u9I/wvNePM5I:Tewjj+pnawB/1Sg94gNNJX7yZ

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5555

Mutex

181a74d35475c4a2137967893bc3cc88

Attributes
  • reg_key

    181a74d35475c4a2137967893bc3cc88

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Unsigned PE 39 IoCs

    Checks for missing Authenticode signature.

Files

  • Neverluse2.zip
    .zip
  • Assets/D3D12/D3D12Core.dll
    .dll windows:6 windows x64 arch:x64

    4928987102696a280994d367bd9459b4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Assets/D3D12/NeLuse.dll
    .dll windows:6 windows x86 arch:x86

    229d526b46d1a78f4d732f107a4d0695


    Headers

    Imports

    Sections

  • Assets/D3D12/opengl32.dll
    .dll windows:6 windows x64 arch:x64

    cb0235011875d5bc5e8f80ed042e1cd8


    Headers

    Imports

    Exports

    Sections

  • NL.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/1.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/10.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/2.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/3.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/4.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/5.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/6.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/7.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/8.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/9.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/Andex.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/Duck.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Plugin/Gren.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/P.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/cam.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/ch.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/chrome.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/cmd.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/dneg.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/explorer.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/explorerr.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/firefox.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/hms.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/inf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/mic.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/mpress.exe
    .exe windows:4 windows x86 arch:x86

    51e7ef6b1d43d0d05d7109dee9789560


    Headers

    Imports

    Sections

  • Plugin/pd.dll
  • Plugin/plg.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/ps.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/pw.dll
    .exe windows:5 windows x86 arch:x86

    720f62ecaae027b5c3ec6686644322e9


    Headers

    Imports

    Sections

  • Plugin/pw.rar
    .rar
  • pw.dll
    .exe windows:5 windows x86 arch:x86

    720f62ecaae027b5c3ec6686644322e9


    Headers

    Imports

    Sections

  • Plugin/red.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/rq.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/sc2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugin/spark.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/t.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugin/vu.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Samples/big_a69f3ee8146e193424e592b8f0edb83f.ico
    .png
  • Samples/construction_cone.icns
  • Samples/sample.icl
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections