General
- Target NinjaCS_v1.8.exe
- Size 1.9MB
- Sample260701-mflaysdy5v
- SHA256 0808ecbe49323d7bb321045422ec0e1a92e67bcffe2b9bbfaa877453f216556d
- MD5 d7cf18648d826f0025cb40e26fa7d525
- SHA1 30faff52c4fff0ad6886e66f871deda41527eb1b
- SHA512 d1c3ef46d8a1c9f0b6937ba347546f9976ff82ac23dad6e218a8c18e246465b6a3f99ea5bb1e7aa00fd9c5a887c979aa38cca8ee120e6fa00a7c4355590cdcc6
- SSDEEP 49152:FcbzJITWJDISmKgNtSruba5/D0c98W2nwylSb6ilkVjVv+:Fcb9D/mKSMSba5wcKZnwylNilkdVm
- TLSH T12E952334B1C6C432DAA26D356AE1D7316B7879212B798ACB97840B6E8F311C0DF35B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NinjaCS_v1.8.exe
Resource
win10v2004-20260513-en
16 signatures
60 seconds
Behavioral task
behavioral2
Sample
NinjaCS_v1.8.exe
Resource
win11ltsc2024-20260629-en
7 signatures
60 seconds
Malware Config
Targets
-
- Target NinjaCS_v1.8.exe
- Size 1.9MB
- SHA256 0808ecbe49323d7bb321045422ec0e1a92e67bcffe2b9bbfaa877453f216556d
- MD5 d7cf18648d826f0025cb40e26fa7d525
- SHA1 30faff52c4fff0ad6886e66f871deda41527eb1b
- SHA512 d1c3ef46d8a1c9f0b6937ba347546f9976ff82ac23dad6e218a8c18e246465b6a3f99ea5bb1e7aa00fd9c5a887c979aa38cca8ee120e6fa00a7c4355590cdcc6
- SSDEEP 49152:FcbzJITWJDISmKgNtSruba5/D0c98W2nwylSb6ilkVjVv+:Fcb9D/mKSMSba5wcKZnwylNilkdVm
- TLSH T12E952334B1C6C432DAA26D356AE1D7316B7879212B798ACB97840B6E8F311C0DF35B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.