General
- Target воздушный членик.exe
- Size 93KB
- Sample260502-a41dkabx2l
- SHA256 178bd33fc4ebd0db8492e27f8cf07add647d0af99d01ca09f2d15006431568e7
- MD5 f67beb614be415fc0234aa0054674538
- SHA1 b1f85ea66eab6134e94906dc8ee1950d1db3fd90
- SHA512 c1d064e7fd577840e280dae6a94a081dfd1b7e73b029fcc275a4face8d53be2c0f5aeb89a45857ca7d5f697b2e2107ca09eff1c48e3f69bedad33daf52ee17df
- SSDEEP 1536:qSy1GkeUqZJO5wNSimjEwzGi1dDODugS:qSdUqZJOeAOi1dIT
- TLSH T1A593E84977E56524E0BF56F75871F2404E34B48B1602E39E48F219AA0B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
воздушный членик.exe
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
воздушный членик.exe
Resource
win11-20260130-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
hakim32.ddns.net:2000
-
v15trw8zsb.localto.net:7236
Mutex
-
f3b12ac9b110385a231791319fef71a8
Attributes
-
reg_key
f3b12ac9b110385a231791319fef71a8
-
splitter
|'|'|
Targets
-
- Target воздушный членик.exe
- Size 93KB
- SHA256 178bd33fc4ebd0db8492e27f8cf07add647d0af99d01ca09f2d15006431568e7
- MD5 f67beb614be415fc0234aa0054674538
- SHA1 b1f85ea66eab6134e94906dc8ee1950d1db3fd90
- SHA512 c1d064e7fd577840e280dae6a94a081dfd1b7e73b029fcc275a4face8d53be2c0f5aeb89a45857ca7d5f697b2e2107ca09eff1c48e3f69bedad33daf52ee17df
- SSDEEP 1536:qSy1GkeUqZJO5wNSimjEwzGi1dDODugS:qSdUqZJOeAOi1dIT
- TLSH T1A593E84977E56524E0BF56F75871F2404E34B48B1602E39E48F219AA0B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Disables Task Manager via registry modification
Modifies Windows Firewall
Drops startup file