njrat | sample1_unsafe

Sharing

Copy URL Twitter E-mail

General

Target
sample1_unsafe
Size 1.9MB
Sample260522-v816wabz4m
SHA256 4f3b59864c18a8d1a8add12e29dfd6293d67c07ecbd0bf9b4ae9e34294bc2668
MD5 e4c2350adc7cb595f67e309d52b2778e
SHA1 08a0784691beeb777d864279612a7237075f94ee
SHA512 8b39225020671ce408deba0b8d0e91dfba51e64552b8b18d9f241f2250ef72769fd55cf2c97047dc3921613d0762a86a93be92f64766b829090c93da795ca8ad
SSDEEP 49152:hd6e6x01stTTAkJ/4p3ZpoWJX+vS6ljM3XyF2:hg1xThKJZpoWJO6UjaCA
TLSH
T19C9533495FD1C08BD88DCE3E1B2ACB96E0BA652047D4A7A38E8B8D306651EF35C54737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer hacked upx trojan njrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

amr555s.no-ip.org:5554

Mutex

f87a088fbd7c06eef1f5a49864be5208

Attributes

reg_key
f87a088fbd7c06eef1f5a49864be5208
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/SpyNet.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
sample1_unsafe
unpack001/Smart Binder v2.0 By Th3 Exploiter.exe
unpack001/SpyNet.exe
unpack002/out.upx

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

sample1_unsafe

.exe 1.9MB
Smart Binder v2.0 By Th3 Exploiter.exe

.exe 23KB
SpyNet.exe

.exe 2.0MB
out.upx

.exe 4.3MB

sample1_unsafe

IMPHASH 29b61e5a552b3a9bc00953de1c93be41
SHA256 4f3b59864c18a8d1a8add12e29dfd6293d67c07ecbd0bf9b4ae9e34294bc2668
MD5 e4c2350adc7cb595f67e309d52b2778e
SHA1 08a0784691beeb777d864279612a7237075f94ee
SHA512 8b39225020671ce408deba0b8d0e91dfba51e64552b8b18d9f241f2250ef72769fd55cf2c97047dc3921613d0762a86a93be92f64766b829090c93da795ca8ad
SSDEEP 49152:hd6e6x01stTTAkJ/4p3ZpoWJX+vS6ljM3XyF2:hg1xThKJZpoWJO6UjaCA
TLSH
T19C9533495FD1C08BD88DCE3E1B2ACB96E0BA652047D4A7A38E8B8D306651EF35C54737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess CreateDirectoryA lstrcmpiA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject GetWindowsDirectoryA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Smart Binder v2.0 By Th3 Exploiter.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c244ca57170c47a61d79092c13a038477a904a416b492adeb5aabe89d1620c30
MD5 f836c26e8aae6e2ba4efb47af6cecf4f
SHA1 65d32c3ed9f9f03033efb50fe8275a3643755f79
SHA512 fa8e33791059323c754589a779b167d21cf515fb786c86a84944cf7fc8784be71842db8ee12953855141d99aab9aa707fbfd972d7229156f73168284dcba8f47
SSDEEP 384:47QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZkb/:485yBVd7Rpcnudb
TLSH
T109B2094E3FA98856C5AC1B74C6B5965003B491870413EE2FCCC554CBAFB3BD92D48AF9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

29838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SpyNet.exe

SHA256 e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
MD5 98de7bcad1ba2caf74007bd97bc2b505
SHA1 8a79d06159a339313b810f23835b8417429dd356
SHA512 ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
SSDEEP 49152:GhwHJZqdp7orGOA0jhE6wSZCTIzY7wXSxQ5E+X6Oftn/Z9s0K:GhwHJZUp7orG90NE6KIM7wXr5EI6OR/7
TLSH
T1BDA5231B40062DE7D22163FE6341EEF642035EC5D8A70251A8FAEDB7B078ED3DD1A295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5447328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 315c2b76dc0912ed0b92f920538d9fc618238ed59e2c12180bcc0a11f566c022
MD5 a2b7fcad8c2c5d3ecefb2a17e4f55302
SHA1 10a3a1af6ad2e9dccf6e6aabbee35ff91c5dcb94
SHA512 06cd7fcc226ea62aa2e3948ba2644b45755ea0689d672b0b8062b6e5021929d78f6c51fa4c12574b59a970c546107ad702a30041ff835e205cdc1541868dc187
SSDEEP 98304:lUxgOX4G5jIkIfEWVv0/7L/+3RfFdDajFLOw2h:lagm4GhFWyZB2h
TLSH
T160268E12F601C9E2D0623779EC16CEF914216E30ED54465339F97F2FBFB07A299291A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

1209296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

927KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

sample1_unsafe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

Smart Binder v2.0 By Th3 Exploiter.exe

mscoree

dotnet

SpyNet.exe

generic

out.upx

generic