Hostile ^100% windows Download

Server.exe

NjRAT malware with C2, persistence, evasion

.NET surveillance RAT stages a network payload.NET screen and webcam capture with network C2

SHA-2562cbfc9f447f6338b365dfd5a9fe5962e1b8f0a8d73ae715128221d9e9939eacb

URLhttps://tria.ge/api/v0/samples/260824-ne1vpafn9z/sample

MaleculeK(Mc)O₄(CCoErI)H₇(Hf₂Cm₂CrDb₂F₄Os₃Po₆)Md₃(BiBk)Th₆

Evidence

.NET screen and webcam capture with network C2 0x2cac–0x2e2c

⋯7 more rows
0x2d1c1e0228b100000a2a1a28200000062a00..(....*.( ...*.
0x2d2c42534a4201000100000000000c000000BSJB............
0x2d3c76322e302e3530373237000000000500v2.0.50727......
⋯15 more rows

.NET surveillance RAT stages a network payload 0x3e2d–0x407d

⋯12 more rows
0x3eed727400546f426173653634537472696ert.ToBase64Strin
0x3efd670046726f6d42617365363453747269g.FromBase64Stri
0x3f0d6e670053797374656d2e546578740045ng.System.Text.E
0x3f1d6e636f64696e67006765745f55544638ncoding.get_UTF8
0x3f2d00476574427974657300476574537472.GetBytes.GetStr
0x3f3d696e670053797374656d2e494f2e436fing.System.IO.Co
0x3f4d6d7072657373696f6e00475a69705374mpression.GZipSt
0x3f5d7265616d0053747265616d00436f6d70ream.Stream.Comp
0x3f6d72657373696f6e4d6f6465007365745fressionMode.set_
⋯17 more rows

Windows volume-information API name reference 0x468d–0x48ad

⋯3 more rows
0x46bd776e0052656d6f7665006a2e65786500wn.Remove.j.exe.
0x46cd61766963617033322e646c6c006b6572avicap32.dll.ker
0x46dd6e656c3332007573657233322e646c6cnel32.user32.dll
⋯6 more rows
0x474d62006c61737463617000504c47002e63b.lastcap.PLG..c
0x475d63746f72004e74536574496e666f726dctor.NtSetInform
0x476d6174696f6e50726f6365737300685072ationProcess.hPr
0x477d6f636573730070726f63657373496e66ocess.processInf
0x478d6f726d6174696f6e436c617373007072ormationClass.pr
0x479d6f63657373496e666f726d6174696f6eocessInformation
0x47ad0070726f63657373496e666f726d6174.processInformat
0x47bd696f6e4c656e67746800636170476574ionLength.capGet
0x47cd4472697665724465736372697074696fDriverDescriptio
0x47dd6e410077447269766572006c70737a4enA.wDriver.lpszN
0x47ed616d650063624e616d65006c70737a56ame.cbName.lpszV
0x47fd657200636256657200476574566f6c75er.cbVer.GetVolu
0x480d6d65496e666f726d6174696f6e004765meInformation.Ge
0x481d74566f6c756d65496e666f726d617469tVolumeInformati
0x482d6f6e41006c70526f6f74506174684e61onA.lpRootPathNa
0x483d6d65006c70566f6c756d654e616d6542me.lpVolumeNameB
⋯7 more rows

Batch with ping delay before deletion 0x499a–0x4c8a

⋯25 more rows
0x4b2a6f006c00610072002e0074006f007000o.l.a.r...t.o.p.
0x4b3a000b31003200360030003900000b7c00..1.2.6.0.9...|.
0x4b4a27007c0027007c00010b460061006c00'.|.'.|...F.a.l.
0x4b5a7300650000095400720075006500005bs.e...T.r.u.e..[
0x4b6a53006f00660074007700610072006500S.o.f.t.w.a.r.e.
0x4b7a5c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x4b8a660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x4b9a770073005c0043007500720072006500w.s.\.C.u.r.r.e.
⋯15 more rows

Encoded content decoded: xor 0x517c–0x525c

⋯3 more rows
0x51ac011280bd0e080003010e0e1180c10500................
0x51bc010e1d0e052002010e1c060003010e0e..... ..........
0x51cc020500021c1c1c04200103080420001d........ .... ..
0x51dc05060002010e1d05021d05100006011c................
0x51ec1280a50e1d1c1d0e1d1280a51300081c................
⋯7 more rows