Trusted Design

Unusual njRat campaign originating from Saudi Arabia

概要

This campaign seems to be old but still running (although my infection wasn’t being manually controlled at the time). The first sample found was submitted 7 months ago. The operation seems to originate from Saudi Arabia mostly; seeing its C2 IP is a home IP address and njRat does not support proxying C2 communciations over infectees. It means this was most likely the actual operator. I have no clue on the exact targets; the website I found was a Dutch website for a hobby group not a really high-ranked target. The spreading method of a fake antivirus website was also quite confusing, normally I see these things dropping FakeAV’s as I’ve written on in the past.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - f67369ff8f2e78a09f5fe80a4ca58dadfda766a24775afcf0c793b47ca124cba -
• FileHash-SHA256 - eac07d10a5cc52c26b72bb43f2ffa30e6e8da7c2bb18c0786d756755ec99e832 -
• FileHash-SHA256 - c50d60fced994896e0b2ad11cac798f9d10db4019fa08c977a2cf4042e6ab798 -
• FileHash-SHA256 - 80e364d140162049f05cbb5bed17ad7348d2f9aff37d2281f83706c4af66be09 -
• hostname - svchost.homelinux.com -
• hostname - supportoffice.likescandy.com -

類似Pulses

• Behind the Modern Botnet (score: 0.56)
• Mogoogwi Malware (score: 0.55)
• Dridex, Vawtrak and others increase focus on Canada (score: 0.55)
• Pawn Storm’s using Java Zero-Day (score: 0.54)
• FakeGlobe and Cerber Ransomware: Sneaking under the radar while WeCry (score: 0.54)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る