WinRAR archive جديد.rar
- SHA256 3833ec01c725597ad1ea57fdea994e0f2e3c539f4fecd2abefc3ce78213d6ada
Overview
overview
10Static
static
3njRAT v0.7...il.dll
windows10-2004-x64
1njRAT v0.7...il.dll
windows11-ltsc_2024-x64
1njRAT v0.7...et.dll
windows10-2004-x64
1njRAT v0.7...et.dll
windows11-ltsc_2024-x64
1njRAT v0.7...er.exe
windows10-2004-x64
3njRAT v0.7...er.exe
windows11-ltsc_2024-x64
3njRAT v0.7...7d.exe
windows10-2004-x64
10njRAT v0.7...7d.exe
windows11-ltsc_2024-x64
3njRAT v0.7...ub.ps1
windows10-2004-x64
3njRAT v0.7...ub.ps1
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
njRAT v0.7d Professional Edition By Dark .NET/stub.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
njRAT v0.7d Professional Edition By Dark .NET/stub.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target WinRAR archive جديد.rar
- Size 1.4MB
- Sample260924-j3d9da1dkh
- SHA256 3833ec01c725597ad1ea57fdea994e0f2e3c539f4fecd2abefc3ce78213d6ada
- MD5 acb1afdc6b1b92800b495047c69f1be6
- SHA1 910d9a23e5239469fb479a736a3d417eaa2f9c0c
- SHA512 dabdf95bddaafc495ff78a0fff54c5f352740d93f68389361f9dec7bbc2ce78d6c713690fc56bc1968dc664d945c62e62cd21b67f3342a69a706dbfd2f65f89a
- SSDEEP 24576:C6AKVGb08aInsJ7rQKt7+Bksnrgm6d6ahXBuyuomm+UvEgn3rarHI7U24tBuU:JAeGb0UseKl6JF7mXBuumm+UsgbarHiA
- TLSH T14C653331750535508CAA120523243F79E02B9B6B7C86C513BE2DBB5B6F3BA967424F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll unpack001/njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll unpack001/njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe unpack001/njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe
File Explorer
-
WinRAR archive جديد.rar.rar 1.4MB
-
njRAT v0.7d Professional Edition By Dark .NET/GeoIP.dat1.2MB
-
njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll.dll 305KB
-
njRAT v0.7d Professional Edition By Dark .NET/Stub.manifest.xml 487B
-
njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll.dll 43KB
-
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe.exe 352KB
-
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe.exe 406KB
-
njRAT v0.7d Professional Edition By Dark .NET/stub.il.ps1 228KB
njRAT v0.7d Professional Edition By Dark .NET/GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Professional Edition By Dark .NET/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1a6f0316931108a810daf959016373747a6017c62c2b1efb7ee049bad6961b19
- MD5 8baae827141c6d2fbf516bea3ec32233
- SHA1 28688944846dba48ab91fe74c721868599270433
- SHA512 3f54393a0810c1a5bf57ecf9ba99fec48cc6ed974c877bbd24bacffb56f4c53db1af60680cb15ce6a3b6253a3d0a3c7d5349e626d924ceeb84106626ec1bd6c2
- SSDEEP 6144:Q2aOs7VRzXl5uigI/6dSB4MCsc4RSbq8tcomGlbDoSeEos:6VR/hF/6dSB5CscQSbqMBlbDFis
- TLSH T1A274012275408E69FAF531F3D562AC2412962F369899640F74B77B4BE8F3D43EC2148E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Hacking Tools\Sources My\Rat Crypter\lion hacker crypter enterypoint new 2014 woooorrrrkkk\WindowsApplication4\WindowsApplication4\obj\x86\Debug\NJRAT 7.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 12c8b5d3a0a5fe18a149da3c33b14b2cd0fb548e4ef491e1d242ae4ad7e7b8e4
- MD5 4d7d74a3cc72e557c5157597c640d275
- SHA1 5b2b48173bcf9d6d8fc1d98b2c67c6b1b1119732
- SHA512 92404a311655ea0ea8e726a0538111d0afa2020c5c786f92679914d77043f91f6030dc6dfdf5d27effbf4c3288a58cf7308489f90b57be3e0d75327e7c7b8ac8
- SSDEEP 6144:I39z4WNnY7qa7F/P+l4FEQMTM4D5+yLG4Ma5RUBkcTk3WKEIok9Fw3rU59tt4ULh:ItUunYGy1BEQMTtT64Mn/A+IBkr09ty
- TLSH T15C940225B4448E6AF8F671F2D491ADA422662F369852981F3573B70DD8F3F03EC2294D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Hacking Tools\Sources My\Rat Crypter\lion hacker crypter enterypoint new 2014 woooorrrrkkk\WindowsApplication4\WindowsApplication4\obj\x86\Debug\NJRAT 7.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
394KB
Virtual Size
394KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Professional Edition By Dark .NET/stub.il
- SHA256 daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
- MD5 2041e64bffccfbc9379235fdf294f188
- SHA1 19c1fd78e8f36493e2a9b1c0e437afc2416586f8
- SHA512 c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
- SSDEEP 6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
- TLSH T1DB34EF2D8228999AD4B2701DBA72CB16F76F12270F716C967CEFD254BF322C54270636
- MD5 SHA1 SHA512 SSDEEP TLSH