General
- Target Payload.exe
- Size 55KB
- Sample260701-zvmhsagv2s
- SHA256 47dbdd6e47ebc4f244340cffb99e7f95ea09a02103cc8c4f2063b02f5d3af0ad
- MD5 f78af0a8a177d3a5b92aad1624c45746
- SHA1 29c757f96f12ce185ae323d71dec3cb180c3e5fc
- SHA512 ce6825f158933a7bd7406914392f4a57727854f62fb2cd0b9c3509313c26c61cf9e6df4740a33a8b0cc0e4dba01c6af7b5f3d15c7786ce6bd7072cb82ce075f6
- SSDEEP 1536:m8pMDnE4uNRty4XTvBhDVwsNMDuXExI3pmQm:9MDnlYk4X9hDVwsNMDuXExI3pm
- TLSH T1E3432744BFEA4A05E2BC8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win11ltsc2024-20260629-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
ضحيه~
C2
-
portbuddy.dev:43082
Mutex
-
37d59cf136573683926ecadb7723f903
Attributes
-
reg_key
37d59cf136573683926ecadb7723f903
-
splitter
Y262SUCZ4UJJ
Targets
-
- Target Payload.exe
- Size 55KB
- SHA256 47dbdd6e47ebc4f244340cffb99e7f95ea09a02103cc8c4f2063b02f5d3af0ad
- MD5 f78af0a8a177d3a5b92aad1624c45746
- SHA1 29c757f96f12ce185ae323d71dec3cb180c3e5fc
- SHA512 ce6825f158933a7bd7406914392f4a57727854f62fb2cd0b9c3509313c26c61cf9e6df4740a33a8b0cc0e4dba01c6af7b5f3d15c7786ce6bd7072cb82ce075f6
- SSDEEP 1536:m8pMDnE4uNRty4XTvBhDVwsNMDuXExI3pmQm:9MDnlYk4X9hDVwsNMDuXExI3pm
- TLSH T1E3432744BFEA4A05E2BC8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
UAC bypass
-
Drops startup file