njrat | JaffaCakes118_28f9e9b9211feefb848e4548d6958df7

General

Target
JaffaCakes118_28f9e9b9211feefb848e4548d6958df7
Size 12KB
Sample250824-p8kagawkv2
SHA256 beecd547898f3272525c03610fc28cdc7ce4b9286b35fed65af66d9a6f086f62
MD5 28f9e9b9211feefb848e4548d6958df7
SHA1 59ba8db5e7529e5f9eafe3d633a942c4ea39f72b
SHA512 5d441bfc0d2e0fb5ca941132b980e018c8b166395b84debe174bc6bf5d39c6471c760e5192a7359180f2a1b7f85446de250cb0ccd7f73b636400e2b36263b81a
SSDEEP 384:rte9VRQ5GRox17Mp3CJNHZBhOMPZESP5TV:rt48Xx1m3CJVZBhZRESpV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hacked njrat

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

adnan7yousf.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

Njrat family
njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ازالة السمايل عن الصوره.exe

File Explorer

JaffaCakes118_28f9e9b9211feefb848e4548d6958df7

.rar 12KB
ازالة السمايل عن الصوره.exe

.exe 29KB

JaffaCakes118_28f9e9b9211feefb848e4548d6958df7

SHA256 beecd547898f3272525c03610fc28cdc7ce4b9286b35fed65af66d9a6f086f62
MD5 28f9e9b9211feefb848e4548d6958df7
SHA1 59ba8db5e7529e5f9eafe3d633a942c4ea39f72b
SHA512 5d441bfc0d2e0fb5ca941132b980e018c8b166395b84debe174bc6bf5d39c6471c760e5192a7359180f2a1b7f85446de250cb0ccd7f73b636400e2b36263b81a
SSDEEP 384:rte9VRQ5GRox17Mp3CJNHZBhOMPZESP5TV:rt48Xx1m3CJVZBhZRESpV
MD5 SHA1 SHA512 SSDEEP

ازالة السمايل عن الصوره.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5d4e994d5290966966fb0e40bf0744799fa0e3c57b828d9366b16538b9c26a7f
MD5 79075b4b3de8062cf24f0e1a84edaedf
SHA1 74995b004f999308bd2258ea3b37a0ba21ce7ea8
SHA512 11c50dc430dc94847d36ea81795ed6ddb2808edf26d650d3be3425ee0e818408b3d61e5a6b140de700fdcb1fa7d311f39e8a3d3ece1b907305fa87daa7a96a8a
SSDEEP 768:bj77ucYfKQTtzjAqc3eUBKh0p29SgRGp:X7hWVUJZKhG29jGp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

JaffaCakes118_28f9e9b9211feefb848e4548d6958df7

ازالة السمايل عن الصوره.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

JaffaCakes118_28f9e9b9211feefb848e4548d6958df7

ازالة السمايل عن الصوره.exe

mscoree

dotnet