njRAT v0.12G.zip
- SHA256 1e055a9f8a9736a965b5615e26eaff24d5e53e6286db804bf043e4432aa61a21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
njRAT v0.12G.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target njRAT v0.12G.zip
- Size 2.1MB
- Sample260604-vva3jabs8s
- SHA256 1e055a9f8a9736a965b5615e26eaff24d5e53e6286db804bf043e4432aa61a21
- MD5 bf9862ecdf72e04d1900d46f4e8a5733
- SHA1 a72b21bfa2093e472527349df7434b43b1fc9cf5
- SHA512 ca1ef4dc813b1392a7daf7411e48650a17ab38b23bbdc430c97cc3d57b8971641f4702af8d7db0a410e4e7dff9dedb439af8c071a35d6ef261f58b802f85a62f
- SSDEEP 49152:N5NPzlQHPw97Coo9d5oYSmFV4o5xzCQcqw+:bNPgw97Cooj5rrVVZCBqw+
- TLSH T13EA5336AA9E38073DCD6D1BFB638341C691A56700E50F43697FFD728AE688B0071B761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/njRAT v0.12G/Mono.Cecil.dll unpack001/njRAT v0.12G/Plugin/cam.dll unpack001/njRAT v0.12G/Plugin/ch.dll unpack001/njRAT v0.12G/Plugin/fun.dll unpack001/njRAT v0.12G/Plugin/inf.dll unpack001/njRAT v0.12G/Plugin/mic.dll unpack001/njRAT v0.12G/Plugin/plg.dll unpack001/njRAT v0.12G/Plugin/pw.dll unpack001/njRAT v0.12G/Plugin/sc2.dll unpack001/njRAT v0.12G/WinMM.Net.dll unpack001/njRAT v0.12G/njRAT v0.12G.exe unpack001/njRAT v0.12G/stub.exe
File Explorer
-
njRAT v0.12G.zip.zip 2.1MB
-
njRAT v0.12G/Alert.wav23KB
-
njRAT v0.12G/GeoIP.dat1.2MB
-
njRAT v0.12G/Mono.Cecil.dll.dll 305KB
-
njRAT v0.12G/Plugin/cam.dll.dll 63KB
-
njRAT v0.12G/Plugin/ch.dll.dll 12KB
-
njRAT v0.12G/Plugin/fun.dll.dll 21KB
-
njRAT v0.12G/Plugin/inf.dll.dll 19KB
-
njRAT v0.12G/Plugin/mic.dll.dll 50KB
-
njRAT v0.12G/Plugin/plg.dll.dll 40KB
-
njRAT v0.12G/Plugin/pw.dll.dll 243KB
-
njRAT v0.12G/Plugin/sc2.dll.dll 12KB
-
njRAT v0.12G/Stub.manifest.xml 487B
-
njRAT v0.12G/WinMM.Net.dll.dll 43KB
-
njRAT v0.12G/njRAT v0.12G.exe.exe 1.5MB
-
njRAT v0.12G/stub [SRC].zip.zip 9KB
-
OK.vb.vbs 46KB
-
njRAT v0.12G/stub.exe.exe 49KB
-
njRAT v0.12G/stub.il342KB
njRAT v0.12G/Alert.wav
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.12G/GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.12G/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
- MD5 e747fa3339c1f138b6bfce707b541d03
- SHA1 b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
- SHA512 b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
- SSDEEP 192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
- TLSH T15642D62577A88B63C96DA77D45A2534133F3D1118222DFAB7DCA68EC4DE63C51B0039B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92a2bb77ac664dce38ef839dad9c9a3d9aece152ed432894654650ea6345fde8
- MD5 c724c870d0d5b291a93a41252e1d46df
- SHA1 57fe1efb9f3dae1138d8a6314a76e7f4c5368242
- SHA512 3505cbc7b6310057e5f21466d5b4a3f0a07a5b5ba05048c6ba87a8ba87a1d213105a33b89bef1febe685a01d37432089ca43e5b377f034a8f07cea3eff7d5f1e
- SSDEEP 384:xiHLTIdCtjOxUX5U5Ig0bDLZqCbbYLRUmEIAx4bTrU:AwdF5Ig0rXI/zU
- TLSH T195A2382993E4C332CC3D17731863631217B29C819A13EF2F4FACB4AA6DB37504E52A95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\NJRAT\Plugin SRC\Pt\Pt\obj\Debug\fun.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/inf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896
- MD5 cef141d894400bc2e0096d1ed0c8f95b
- SHA1 1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2
- SHA512 794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7
- SSDEEP 384:XioX36zZ00sK2qbc+LROMnDdU6cpobsTP4Fj:SC3wS0/9dcpFgj
- TLSH T1A792D805F3E86028EEBD1B329EB3C7616276BE274D2EC62F09D8715D19B23404A71B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\NF\NF\obj\Debug\NF.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 25d1969fb395caef8d9122f9befd597d0cb93a687d7703a42f06119d92520cc4
- MD5 a93349ba5e621cfb7a46dc9f401fd998
- SHA1 6668b353baa6fc7aaeb30b0cf86d5e878199464d
- SHA512 9d911ec49a0d79f2e9dd1d7d8aa119b18ad3aa74adf5027357bd2a7b187c8aee2be502debcdf0fb7b5198604a256935e91d5c2ff8ac2c32c46e1738a3d50612b
- SSDEEP 768:52Gyq9nJOybLlGvuWLgRDuB6VxGPZSCmjpUTsFlNBZyxzbIVF9dpfo7G9Rp6oXG/:cGyq9nJOybLlGvuWLgFu4HGPZSCmjpMb
- TLSH T11703B7CC67E48724D63E4B734A6177434BF99A264A42D53F4EE4F0F62AB37A48B00716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\NJRAT\Plugin SRC\plg\obj\x86\Debug\plg.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
98B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e0ccd6be2a8d6eb045363c44af34e7b1482856e64b4b9cfc3deae465e3cdccd
- MD5 11375fb0cee4c06b5cefa2031ee2ed6d
- SHA1 4c1a4f627494715197e233775ab4dae219b2df89
- SHA512 48e7de4d2496f39073b070b3de1370a7f4ad6837af72f5aff7e8ca6c9cffc3a2019651bb14138346779ad404e230c2254f7bda4cb9555638575ad2bec6c9c337
- SSDEEP 6144:+e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMOy:xxJ/JmSG9T8CEgdM
- TLSH T17734122E37524831D95FCD7A40A3F34263B68C619B53A61F2BE832461F735E58A42F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
252702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\im523\Desktop\Plugin njrat 0.7d src\pw\obj\x86\Debug\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
121B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
njRAT v0.12G/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/njRAT v0.12G.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 58bdda4552f79fd92c9934ca46738ae7f1aa5cf08b8ac41c47532825857174d9
- MD5 7e23b13fe4364aa8238cece97b6b2b0e
- SHA1 1fcee9b6ebc82168a69f84d8ae9bf47ab930bfa4
- SHA512 b3d36f95eb959890f63a709ff1c5787083f0f7c484883cfcfcbb970cf4cd47f66f27d20735d47f35a967f97b17ddfeb34017961f3b0beb0b00312234c9fc7519
- SSDEEP 24576:lHXxfXDrFyxWPAKVCEJl93mqzUcqUcSBxcCAW:l3ZRyxW3E2WqqUFXA
- TLSH T19A7539013D51DD51F95A2237D2DF806C47B99C116AE2E32BB9F8363964263E3BC08ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1590158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
njRAT v0.12G.pdb
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/stub [SRC].zip
- SHA256 124d2c06b5cf48bea4f78c122b15ef9a693d4afb6e914f61c9230e3afc42efc1
- MD5 b76e8c4acd4069429f59335b74778d8d
- SHA1 97f9ee8e98a6743db20384d93d336341a4cd9e75
- SHA512 1c7db772af237a370e5cc6a187eb9bf0af6a3503b548443ac632a04139e1d502414c7eb79695ab8980fad3d9e845eae7f7407e0bfdff0cbbb3c439058454d9d7
- SSDEEP 192:h4VldJT6RVEzHCsgSnqU3v4xtE//919TsoxCL8zxLSSe5aUGS3E:CzLB7Vg2d3v4xu//9LsCCLCe/RGS3E
- TLSH T15F12BECC9558B26F4A3F507CF646DB213AA401DA32DA93B0AF62DB2D3F67C638C15140
- MD5 SHA1 SHA512 SSDEEP TLSH
OK.vb
- SHA256 28d5486f0cbe705253b2d0b28fb1111c6ba9b44e36c9d0489b7dd5e3288c76cc
- MD5 378e188fdfdc96bb041d52ef6a2c8017
- SHA1 18b483b28b5cc6495b60298cc896800f98d8bd6e
- SHA512 118ad7638cac699f74789f2ae6722da9f7417e3167ae653c805bb4f61c45e45a96a0be46611e53422eeb3c16093e43889eef61154dbc2f55c601437009cef494
- SSDEEP 384:JlWEYDc7abAnY/HHAaufcYbDl5EQBirbmwb1ombAYWm5WtKeEtrAweC5+YHh0SL4:GnkmWKrwa1WAggxhZVBRa
- TLSH T1E12381273D03257445BF8D196E2EA458F9D37EA712398CA0F48C41D10FB55EDD2A0BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.12G/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 17f15d995e24336d0594731d548d51c7830a67a41cd081fed2b28a3079f57719
- MD5 f26f453f9b893a2c8bd6ed9c9a08d85a
- SHA1 1781d3be1f658d3cf057ddabf08f3a52eb972f92
- SHA512 067e718e4b2d2cab6184763350d2cac1c928983168dd981fc81e0ad01c7230c698a5eac3a9954280f579f0bc525f4b6a75fd34b31efb7395805ac4bd75391023
- SSDEEP 768:iNt5wqwd6swNo9RGXCwVjwfv0NjeRBUjYcse5qD7ulm:iNwro29Qt6ENW7e5qD7u8
- TLSH T15333600B63ED6DA1D47D0B753B3347C18379DD064A13D62E0DD860996ABE3837A01BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
G:\NJRAT\stb\obj\Debug\stub.pdb
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.12G/stub.il
- SHA256 7a23b2a867b0607b9d16a6541cb5913af0fdf03d4caf5772b9942fa5f7928a7c
- MD5 477908bbd6ed1956fc8c3b1f054d1ae1
- SHA1 39cc84db4a9f000d8c812140b3f4d3949a4d1897
- SHA512 208f38fa2f5314aa74e468a7a146c5919469f7cdea33d2abb3edd3e7b30f85884e16b76fc14bfde8d253364252245b5b1e4d77777152fad9b7ad2ddecd147994
- SSDEEP 6144:z4jkYLlOW/QpeCeoBQASQrCX743hDyrxznEYy7JhjFhXEFvUpZaz6tt:z4jkYLlOW/QpeCbSQrCX743hDyrlnEYu
- TLSH T15D74012D82289585D4B2601DBB72CB46F7AF52270F727C963CDFD654BF32289427423A
- MD5 SHA1 SHA512 SSDEEP TLSH