Builder njRAT 0.7 MultiHost By v_B01.rar
- SHA256 f1887278d5e2e7ee551db595c6237afa80cb9d38d4e4eab22057a982a370bcc3
Password
tr
Behavioral task
behavioral1
Sample
Builder njRAT MultiHost/Builder njRAT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Builder njRAT MultiHost/Builder njRAT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Builder njRAT MultiHost/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Builder njRAT MultiHost/Mono.Cecil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Builder njRAT 0.7 MultiHost By v_B01.rar
- Size 134KB
- Sample261001-ysf3jsys3n
- SHA256 f1887278d5e2e7ee551db595c6237afa80cb9d38d4e4eab22057a982a370bcc3
- MD5 735ee2bcdfb492194b08890d75858390
- SHA1 717eae2638195a3d68296789eb0787dfea5d6f16
- SHA512 2f9aba4923d7820ff9c03f89a6290816770d79681732bdde9a028fd5ca93124dab1e036103eb2ae7746e37128b32ba74a08643bf0e05de02b1d6a693f7ba6dcb
- SSDEEP 3072:Om2suQW51dZWYtsBqJJZO+joYzYtJ2PeKsUM2KMfYbFDFp:OvQwoYtsMvjoM22G1t2KMfY1b
- TLSH T1C1D312B4F5FB710084A21B2326D50B74E566F2B51C794E39C861AE2BFE4DD7188F0325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
0.7 MultiHost
C2
-
[H]:[P]
Mutex
-
[RG]
Attributes
-
reg_key
[RG]
-
splitter
[SPLIT]
Signatures
File Explorer
-
Builder njRAT 0.7 MultiHost By v_B01.rar.rar 134KB
-
Builder njRAT MultiHost/Builder njRAT.exe.exe 50KB
-
Builder njRAT MultiHost/Mono.Cecil.dll.dll 305KB
-
Builder njRAT MultiHost/Stub.exe.exe 25KB
Builder njRAT MultiHost/Builder njRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 39290a484219fc7e6cc79924941032cbb93dcc6a334fa5c57efe265f6a7e7113
- MD5 6dd503c6b0fee01ef0459355b14a2ce0
- SHA1 b396e771e4052836e2bd9b44f2af41b9d18310c6
- SHA512 b71c41059e9dc5871713011f9d9041495aa0565c0f32ec47c449284a08bbf9d45cf61d65063a3c04328228fb7858e061866e7249238de29264a7f9b58849e87a
- SSDEEP 768:sHN6T68nsPzX3EqhOHJ9nwzXWYvnOAfZoGnGvIcwvOoacpc:sHN6T68aEvqbfOO3nmIcwvOoaD
- TLSH T115334A0322CDBEA7E17C1630773246D1C3F9CE150212EA1E6DC961A999FE6477B027D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
tr
Minor OS version
0
Major OS version
4
Entry point
44590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\01\Secret\$ MyProjects\Completed\Builder njRAT\Builder njRAT\obj\Release\Builder njRAT.pdb
mscoree
_CorExeMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Builder njRAT MultiHost/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
tr
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Builder njRAT MultiHost/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4ab6aae701e572f0361b8d3fd1618da7120a470fbc6b988274981b3841f00fc5
- MD5 d9c634796ef76113ec5d2f2256d366c0
- SHA1 68bf82c7baebe4c881af0fd7a156abbfda1fd908
- SHA512 e30c2586dca846da2e260019cfe3f90862051f8f996669910c7116bf47591e355a62edab100739ba8648678768e75ecfa7d8a7e47d26d41ef494cdb5e90b6380
- SSDEEP 384:CoEKeh7R+GCfM1807W2DTE9zK/qMQvztxLIeJSmek3gEdfnBj:CFkRa5k9Oo1DQ8nBj
- TLSH T1D2C22B0C77A4C326C6FC17B99EE293224376E0531113E72E4DD698EA6EB77D20841EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
tr
Minor OS version
0
Major OS version
4
Entry point
31374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\01\Secret\DP\njRAT v0.8a\vN\vN\obj\Release\vN.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ