Overview
overview
10Static
static
10stubs/Anti.exe
windows10-2004-x64
3stubs/Anti.exe
windows11-ltsc_2024-x64
3stubs/Stub.exe
windows10-2004-x64
10stubs/Stub.exe
windows11-ltsc_2024-x64
10stubs/dlen...nt.exe
windows10-2004-x64
3stubs/dlen...nt.exe
windows11-ltsc_2024-x64
3stubs/dlnormal.exe
windows10-2004-x64
7stubs/dlnormal.exe
windows11-ltsc_2024-x64
7Ultimate-R...on.dll
windows10-2004-x64
1Ultimate-R...on.dll
windows11-ltsc_2024-x64
1Ultimate-R...il.dll
windows10-2004-x64
1Ultimate-R...il.dll
windows11-ltsc_2024-x64
1Ultimate-R...Ra.exe
windows10-2004-x64
1Ultimate-R...Ra.exe
windows11-ltsc_2024-x64
1Ultimate-R..._u.rtf
windows10-2004-x64
1Ultimate-R..._u.rtf
windows11-ltsc_2024-x64
1Ultimate-R...ss.exe
windows10-2004-x64
7Ultimate-R...ss.exe
windows11-ltsc_2024-x64
7Ultimate-R...am.dll
windows10-2004-x64
3Ultimate-R...am.dll
windows11-ltsc_2024-x64
3Ultimate-R...ch.dll
windows10-2004-x64
3Ultimate-R...ch.dll
windows11-ltsc_2024-x64
3Ultimate-R...ic.dll
windows10-2004-x64
1Ultimate-R...ic.dll
windows11-ltsc_2024-x64
1Ultimate-R...lg.dll
windows10-2004-x64
3Ultimate-R...lg.dll
windows11-ltsc_2024-x64
3Ultimate-R...pw.dll
windows10-2004-x64
3Ultimate-R...pw.dll
windows11-ltsc_2024-x64
3Ultimate-R...c2.dll
windows10-2004-x64
1Ultimate-R...c2.dll
windows11-ltsc_2024-x64
1Ultimate-R...et.dll
windows10-2004-x64
1Ultimate-R...et.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 18:05
Behavioral task
behavioral1
Sample
stubs/Anti.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
stubs/Anti.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
stubs/Stub.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
stubs/Stub.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
stubs/dlentrypoint.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
stubs/dlentrypoint.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
stubs/dlnormal.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
stubs/dlnormal.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRa.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRa.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_u.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_u.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.exe
- Size 16KB
- Sample261018-wpf72asycs
- SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
- MD5 b21947a28760750689f46e071d575d07
- SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
- SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
- SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
- TLSH T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anti.exe AntiProcess.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AntiProcess.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe 4820 AntiProcess.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 AntiProcess.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-RAT-Collection-NjRat\njRAT v0.7d Golden Edition - Rus\njRAT v0.7d Golden Edition - Rus\Plugin\AntiProcess.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-RAT-Collection-NjRat\njRAT v0.7d Golden Edition - Rus\njRAT v0.7d Golden Edition - Rus\Plugin\AntiProcess.exe"1⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820