General
- Target https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
- Sample260718-nvy12adv71
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
Resource
win10ltsc2021-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
Resource
win11-20260513-en
15 signatures
150 seconds
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Victim
C2
-
bore.pub:40498
Mutex
-
81a67b839f4692420d45ee7f4b24f8af
Attributes
-
reg_key
81a67b839f4692420d45ee7f4b24f8af
-
splitter
Y262SUCZ4UJJ
Targets
-
- Target https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/Payload.exe
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.