General
-
Target
Payload.exe
-
Size
71KB
-
MD5
059beef828b555a0d90d944d26f8bf71
-
SHA1
3194f8247da47781a652c779e6827be3f7d1caa7
-
SHA256
53870cafc093a006bcff926989904193a84757a3bd3bb6bc9d2f02bb897f4e81
-
SHA512
31f59078fc35f7d40aca5d3a9c81475be5312cd66e27d63c8ff557591fadd74e652c09a8bb638967f8f9e88e4ae727f3686451ccbc7e616e37e4e3cd65637b70
-
SSDEEP
1536:OIeFWPjlcKco3Skqg9fZIc9Urt5f2F0iZAi9aIftfKyxT04GNrztiBVXiKMt9PMn:nYo9fZIftlIfrT04xX/q9PmaF9bI
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Platinum
Botnet
Victim
C2
http://afwa2w3fafs.store/BURHAN-ALASSAD:88
Mutex
svchost.exe
Attributes
-
reg_key
svchost.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Payload.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections