General

  • Target
    Kox_Spoofer__LEAKED_.rar
  • Size 16.4MB
  • Sample250115-xt7ffstlar
  • SHA256 cd2fdd55b920a87b56eaca6f8b1b78db347a4b4b42a1e67a0f0c4d1e09c19c06
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • njrat

Version
  • im523

Botnet
  • HacKed

C2
  • 147.185.221.24:50768

Mutex
  • 543f49bacff49231d84b60f449c28484

Attributes
  • reg_key

    543f49bacff49231d84b60f449c28484

  • splitter

    |'|'|

Signatures

  • Njrat family
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Kox_Spoofer__LEAKED_.rar
    .rar 16.4MB
  • Spoofer/Interface/Magick.Native-Q16-arm64.dll
    21.4MB
  • Spoofer/Interface/Magick.Native-Q16-x64.dll
    .dll 24.0MB
  • Spoofer/Interface/libcrypto-3-x64.dll
    .dll 4.5MB
  • Spoofer/Interface/libssl-3-x64.dll
    .dll 802KB
  • Spoofer/MonoPosixHelper.dll
    .dll 773KB
  • Spoofer/SpooferByKox.exe
    .exe 37KB
  • Spoofer/bypass/api-ms-win-core-memory-l1-1-0.dll
    .dll 11KB
  • Spoofer/bypass/api-ms-win-core-namedpipe-l1-1-0.dll
    .dll 11KB
  • Spoofer/bypass/api-ms-win-core-processenvironment-l1-1-0.dll
    .dll 12KB
  • Spoofer/bypass/api-ms-win-core-processthreads-l1-1-0.dll
    .dll 13KB
  • Spoofer/bypass/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 11KB
  • Spoofer/how-to-use (EN).txt
    62B
  • Spoofer/mono-2.0-bdwgc.dll
    .dll 4.7MB

Kox_Spoofer__LEAKED_.rar

  • SHA256 cd2fdd55b920a87b56eaca6f8b1b78db347a4b4b42a1e67a0f0c4d1e09c19c06
  • MD5 SHA1 SHA512 SSDEEP