General
- Target Server.exe
- Size 93KB
- Sample260701-zjbbdaev3p
- SHA256 e82a5d7ca8475bd66bff1a78a5948d77ce24ab891c3cb19e4fac62e77ed8714c
- MD5 07d89cd7dcec4f5cb20ab3ee02ce0196
- SHA1 518429573909f0b9655ed78b2fe2c11c6273bca9
- SHA512 cf679cc8ca595555c0a9559d3cd2fa7f449ca9d95f3691229f5743baae0d63f705b1858871a5ffc2129ac06456060bea08ce0936eb85dda727d2d1f8e2a23be7
- SSDEEP 768:6Y3JlfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3fsGdp5gM:3l5WhIUKcuOJhPhBjEwzGi1dDrD5gS
- TLSH T1DB93E74977E56524E1BF56F79871F2004F34B48B1612E39D48F219AA0A33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Server.exe
Resource
win11-20260513-en
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11ltsc2024-20260629-en
7 signatures
900 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
ضحيه
C2
-
hakim32.ddns.net:2000
-
127.0.0.1:4111
Mutex
-
4156b5e6d404780d4edce54a2eb73540
Attributes
-
reg_key
4156b5e6d404780d4edce54a2eb73540
-
splitter
|'|'|
Targets
-
- Target Server.exe
- Size 93KB
- SHA256 e82a5d7ca8475bd66bff1a78a5948d77ce24ab891c3cb19e4fac62e77ed8714c
- MD5 07d89cd7dcec4f5cb20ab3ee02ce0196
- SHA1 518429573909f0b9655ed78b2fe2c11c6273bca9
- SHA512 cf679cc8ca595555c0a9559d3cd2fa7f449ca9d95f3691229f5743baae0d63f705b1858871a5ffc2129ac06456060bea08ce0936eb85dda727d2d1f8e2a23be7
- SSDEEP 768:6Y3JlfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3fsGdp5gM:3l5WhIUKcuOJhPhBjEwzGi1dDrD5gS
- TLSH T1DB93E74977E56524E1BF56F79871F2004F34B48B1612E39D48F219AA0A33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Firewall
-
Drops startup file