njrat | 31072026_1709_New Client[.]exe[.]zip

General

Target
31072026_1709_New Client.exe.zip
Size 159KB
Sample260731-vn9bracm8x
SHA256 2ac92f310e85ff91c482a02d7466ffd5be22a72161bd7cea578124569d16309a
MD5 86790a3d33704466d100f0248a6f5d41
SHA1 af7e1f2d5fef364ec1bae8063e71ba1a4aa899ad
SHA512 aaf046c35dda336eb7a99214914e00eed249cee90dfde0789b67c5b28f1ce1fac14e6025e8d51bc6ba254707ed13a6d62c28a6f726f464fd9071d84ad1e0f077
SSDEEP 3072:Bqm9hmDpa+VVDxFh1BxPkBaJcprfH3mkl0mOlylll+ilkHmllillll+mNllllsXK:aVnDBxcBa6pUePbVkIHjhuF
TLSH
T141F3194A764A4B55D56C26B1C0DF662403F1AED3AA32E68D3F8472DE1F032D36E0D6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan njrat

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/New Client.exe

File Explorer

31072026_1709_New Client.exe.zip

.zip 159KB
New Client.exe

.exe 159KB

31072026_1709_New Client.exe.zip

SHA256 2ac92f310e85ff91c482a02d7466ffd5be22a72161bd7cea578124569d16309a
MD5 86790a3d33704466d100f0248a6f5d41
SHA1 af7e1f2d5fef364ec1bae8063e71ba1a4aa899ad
SHA512 aaf046c35dda336eb7a99214914e00eed249cee90dfde0789b67c5b28f1ce1fac14e6025e8d51bc6ba254707ed13a6d62c28a6f726f464fd9071d84ad1e0f077
SSDEEP 3072:Bqm9hmDpa+VVDxFh1BxPkBaJcprfH3mkl0mOlylll+ilkHmllillll+mNllllsXK:aVnDBxcBa6pUePbVkIHjhuF
TLSH
T141F3194A764A4B55D56C26B1C0DF662403F1AED3AA32E68D3F8472DE1F032D36E0D6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

New Client.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 95c14e429e7e05a2dfdf9541c52fce05386dfec85c30611edbdd9fd0f469ac85
MD5 b99d737af02dc9576a21744d42fd2614
SHA1 67e5e2e2acde3dd67153cd60106d71d1787acdb5
SHA512 cff8615246f81e59a7aaadba2bf8947344e9b60dc0d334a2c8e4c44e4a77e37af1947d94ba83153e1ad2efeb97c2376ca3b55aec16009573a83bff93c3b604e3
SSDEEP 3072:sqm9hmDpa+VVDxFh1BxPkBaJcprfH3mkl0mOlylll+ilkHmllillll+mNllllsX:tVnDBxcBa6pUePbVkIHjhu
TLSH
T1C8F3194A764A4B55D56C26B1C0DF662403F1AED3AA32E68D3F8472DE1F032D36E0D6C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

167134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

31072026_1709_New Client.exe.zip

New Client.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

31072026_1709_New Client.exe.zip

New Client.exe

mscoree

dotnet