MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 13

Intelligence 13 IOCs YARA 4 File information Comments

SHA256 hash:	08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54
SHA3-384 hash:	41f66bcf5d8f057857afde8fee102eba3f7450da41eb5c9ffd87067e533a66cb2475761d6595618cd8ecd189202ef176
SHA1 hash:	3467ad35ef62b07324768e4bbc89bc8365cfe520
MD5 hash:	0ef956dd02e25df45ddfd4dec38b8fb9
humanhash:	undress-romeo-eleven-carpet
File name:	csrss.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	25'600 bytes
First seen:	2026-03-10 14:57:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep	384:6LtbQsVJwYVQOmZmwpR6AfWq/ie+SOFa3zmLT2gP/Zw3k5MW4O4ShqrD1hKmvCvN:ktbQECYYZm4df3/j6fPgsh2D1hKeCvN
Threatray	4 similar samples on MalwareBazaar
TLSH	T1FAB23C0877E08624DAFF2FB6096397A90773D2474836DB1E2CD865DBBA37A8606101F5
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	juroots
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

255

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

njrat

ID:

File name:

csrss.exe

Verdict:

Malicious activity

Analysis date:

2026-03-10 15:00:03 UTC

Tags:

rat njrat bladabindi auto-startup auto-reg remote s400 xworm stealer

Link:

https://app.any.run/tasks/8c51dbf8-0fd5-4a52-93d4-89a56809952b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/56951/

Detection(s):

Win.Packed.Msilzilla-10042722-0

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b03154e5dc8e2b2c321a48

Tags:

bladabindi autorun lien

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54

Verdict:

Malicious

File Type:

exe x32

Detections:

Trojan.Win32.Agent.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Ransom.MSIL.Blocker.gen Backdoor.MSIL.Agent.sb Backdoor.Bladabindi.TCP.ServerRequest Backdoor.Bladabindi.TCP.C&C Backdoor.Agent.TCP.C&C Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Dnoper.sb PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen not-a-virus:HEUR:PSWTool.MSIL.BroPass.gen not-a-virus:PSWTool.MSIL.BroPass.sb

Link:

https://opentip.kaspersky.com/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54/results?tab=lookup

Malware family:

njRAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/40eda1e5-ada9-4635-9735-8d0bc30dff7f

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54/

Verdict:

Malicious

Threat:

Family.NJRAT

Link:

https://tip.neiki.dev/file/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54

Threat name:

ByteCode-MSIL.Backdoor.NjRAT

Status:

Malicious

First seen:

2026-03-10 11:57:34 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bdvbsylvj2jnkizqjynvzmhy53r56gmpi2ypjfnnalztlsuilvka._file

Verdict:

malicious

Label(s):

njrat

neptunerat

njrat

0be318b96dac72f7b156663fe4bedd1c63907d6d2a918d8d76af094743a52761

njrat

790be898816a33745a2b31b14aaf3a876d61fcc5cf587368c759625f127dd18d

njrat

error

njrat

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence spyware stealer

Link:

https://tria.ge/reports/260310-sbr6ladz5s/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Adds Run key to start application

Checks computer location settings

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54

MD5 hash:

0ef956dd02e25df45ddfd4dec38b8fb9

SHA1 hash:

3467ad35ef62b07324768e4bbc89bc8365cfe520

Link:

https://www.unpac.me/results/ddae4747-fea7-47e0-98a7-ea221d03f717/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/08ea1961754e92d523304e1b5cb0f8eee3df198f46b0f495ad02f335ca885d54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon