MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1c9708a7c1cca2ffb1fb6711828553521a81c313bd3dcefba441e546d2457e5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 17
| SHA256 hash: | 1c9708a7c1cca2ffb1fb6711828553521a81c313bd3dcefba441e546d2457e5d |
|---|---|
| SHA3-384 hash: | cdff5936d1ccff01da49600f2cdc66b3ce5d2646a00778228e4aae1b75f384c5acb6f9719db858d74b5997818a7a7cb3 |
| SHA1 hash: | 9d3f4a0595af9c10731ea2e9f198c462b2d73dec |
| MD5 hash: | f078c4f43ad9bd1eaf54946c84fdb78e |
| humanhash: | lactose-edward-zebra-west |
| File name: | CARPETA DE FOLIO Y ACTA ENTREGADA-PDF.SCR |
| Download: | download sample |
| Signature | njrat |
| File size: | 1'311'082 bytes |
| First seen: | 2023-07-08 09:09:58 UTC |
| Last seen: | 2025-06-12 08:40:34 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 24576:9VgmnudJ41JhQdiZoGDbbtadASRTcibq/7dTYpzWRuhIDTAekW:9VSr42+vtMZNDbydTQWRuaDTJX |
| Threatray | 2'203 similar samples on MalwareBazaar |
| TLSH | T10D551241B6CA98B1D9631A711A39A720593B7D100F78C64F63DC3D2FBBB32816921B77 |
| TrID | 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | 68d8d8c8d9a9c1d9 (96 x SnakeKeylogger, 67 x RemcosRAT, 66 x Formbook) |
| Reporter |  JAMESWT_WT |
| Tags: | APT-C-36 BlindEagle exe NjRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
369
Origin country :
ITVendor Threat Intelligence
Malware family:
remcos
ID:
1
File name:
CARPETA DE FOLIO Y ACTA ENTREGADA-PDF.SCR
Verdict:
Malicious activity
Analysis date:
2023-07-08 09:12:46 UTC
Tags:
rat remcos njrat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Launching a process
Sending a custom TCP request
Creating a process with a hidden window
Creating a file
DNS request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Using obfuscated Powershell scripts
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware lolbin masquerade overlay packed replace setupapi shdocvw shell32
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Verdict:
Malicious
Detection:
remcos
Threat name:
Win32.Trojan.Remcos
Status:
Malicious
First seen:
2023-07-08 09:09:46 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
remcos
njrat
Similar samples:
+ 2'193 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:njrat family:remcos botnet:matarifejulio6 botnet:nyan cat persistence rat trojan
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Remcos
njRAT/Bladabindi
Malware Config
C2 Extraction:
nj0509.duckdns.org:0509
matarife.duckdns.org:2798
matarife.duckdns.org:2798
Unpacked files
SH256 hash:
a4065ddfc801dcde6eb5d679b03d6010ee6f41e7b3eb902cd6be05504f81fe4f
MD5 hash:
f9ce87b971216d976376d9974326fcc4
SHA1 hash:
e04dcfdc0ddbeadd466843e3fd884a112d9ad1d3
SH256 hash:
611c2707ff453016101ac9985e905001b8c8e6378d0db9f19ed057620f65e2b9
MD5 hash:
0632a1031b137f3342078b07d57490ac
SHA1 hash:
dac29d5976da6038ef7252ef9e08cf8f380e33bf
SH256 hash:
3dd4776020beb430b4bed6872ad5a0ae83b214025740c1f95d71eb97b52c4631
MD5 hash:
e7fd21e687dddfc0d0fc9f8f3dbe7065
SHA1 hash:
88ebb2978db5cef73d282b4c812c1bafceea5532
Detections:
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
2169413bb06b6fb079b39aa6249ad85b7809d4be2f9ee0c72bffcd4b3e30f4a8
MD5 hash:
ba3cc2dd0d9f47d2bc1cc90dba53f7da
SHA1 hash:
4648eebd214397e194192658cfc8ae74d65245ba
SH256 hash:
a4065ddfc801dcde6eb5d679b03d6010ee6f41e7b3eb902cd6be05504f81fe4f
MD5 hash:
f9ce87b971216d976376d9974326fcc4
SHA1 hash:
e04dcfdc0ddbeadd466843e3fd884a112d9ad1d3
SH256 hash:
611c2707ff453016101ac9985e905001b8c8e6378d0db9f19ed057620f65e2b9
MD5 hash:
0632a1031b137f3342078b07d57490ac
SHA1 hash:
dac29d5976da6038ef7252ef9e08cf8f380e33bf
SH256 hash:
3dd4776020beb430b4bed6872ad5a0ae83b214025740c1f95d71eb97b52c4631
MD5 hash:
e7fd21e687dddfc0d0fc9f8f3dbe7065
SHA1 hash:
88ebb2978db5cef73d282b4c812c1bafceea5532
Detections:
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
2169413bb06b6fb079b39aa6249ad85b7809d4be2f9ee0c72bffcd4b3e30f4a8
MD5 hash:
ba3cc2dd0d9f47d2bc1cc90dba53f7da
SHA1 hash:
4648eebd214397e194192658cfc8ae74d65245ba
SH256 hash:
a4065ddfc801dcde6eb5d679b03d6010ee6f41e7b3eb902cd6be05504f81fe4f
MD5 hash:
f9ce87b971216d976376d9974326fcc4
SHA1 hash:
e04dcfdc0ddbeadd466843e3fd884a112d9ad1d3
SH256 hash:
611c2707ff453016101ac9985e905001b8c8e6378d0db9f19ed057620f65e2b9
MD5 hash:
0632a1031b137f3342078b07d57490ac
SHA1 hash:
dac29d5976da6038ef7252ef9e08cf8f380e33bf
SH256 hash:
3dd4776020beb430b4bed6872ad5a0ae83b214025740c1f95d71eb97b52c4631
MD5 hash:
e7fd21e687dddfc0d0fc9f8f3dbe7065
SHA1 hash:
88ebb2978db5cef73d282b4c812c1bafceea5532
Detections:
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
2169413bb06b6fb079b39aa6249ad85b7809d4be2f9ee0c72bffcd4b3e30f4a8
MD5 hash:
ba3cc2dd0d9f47d2bc1cc90dba53f7da
SHA1 hash:
4648eebd214397e194192658cfc8ae74d65245ba
SH256 hash:
a4065ddfc801dcde6eb5d679b03d6010ee6f41e7b3eb902cd6be05504f81fe4f
MD5 hash:
f9ce87b971216d976376d9974326fcc4
SHA1 hash:
e04dcfdc0ddbeadd466843e3fd884a112d9ad1d3
SH256 hash:
a4065ddfc801dcde6eb5d679b03d6010ee6f41e7b3eb902cd6be05504f81fe4f
MD5 hash:
f9ce87b971216d976376d9974326fcc4
SHA1 hash:
e04dcfdc0ddbeadd466843e3fd884a112d9ad1d3
SH256 hash:
611c2707ff453016101ac9985e905001b8c8e6378d0db9f19ed057620f65e2b9
MD5 hash:
0632a1031b137f3342078b07d57490ac
SHA1 hash:
dac29d5976da6038ef7252ef9e08cf8f380e33bf
SH256 hash:
611c2707ff453016101ac9985e905001b8c8e6378d0db9f19ed057620f65e2b9
MD5 hash:
0632a1031b137f3342078b07d57490ac
SHA1 hash:
dac29d5976da6038ef7252ef9e08cf8f380e33bf
SH256 hash:
3dd4776020beb430b4bed6872ad5a0ae83b214025740c1f95d71eb97b52c4631
MD5 hash:
e7fd21e687dddfc0d0fc9f8f3dbe7065
SHA1 hash:
88ebb2978db5cef73d282b4c812c1bafceea5532
Detections:
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
SH256 hash:
3dd4776020beb430b4bed6872ad5a0ae83b214025740c1f95d71eb97b52c4631
MD5 hash:
e7fd21e687dddfc0d0fc9f8f3dbe7065
SHA1 hash:
88ebb2978db5cef73d282b4c812c1bafceea5532
Detections:
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
Remcos
win_remcos_auto
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
SH256 hash:
2169413bb06b6fb079b39aa6249ad85b7809d4be2f9ee0c72bffcd4b3e30f4a8
MD5 hash:
ba3cc2dd0d9f47d2bc1cc90dba53f7da
SHA1 hash:
4648eebd214397e194192658cfc8ae74d65245ba
SH256 hash:
2169413bb06b6fb079b39aa6249ad85b7809d4be2f9ee0c72bffcd4b3e30f4a8
MD5 hash:
ba3cc2dd0d9f47d2bc1cc90dba53f7da
SHA1 hash:
4648eebd214397e194192658cfc8ae74d65245ba
SH256 hash:
1c9708a7c1cca2ffb1fb6711828553521a81c313bd3dcefba441e546d2457e5d
MD5 hash:
f078c4f43ad9bd1eaf54946c84fdb78e
SHA1 hash:
9d3f4a0595af9c10731ea2e9f198c462b2d73dec
Detections:
win_xorist_auto
Malware family:
njRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | iexplorer_remcos |
|---|---|
| Author: | iam-py-test |
| Description: | Detect iexplorer being taken over by Remcos |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
| Rule name: | pe_imphash |
|---|
| Rule name: | Remcos |
|---|---|
| Author: | kevoreilly |
| Description: | Remcos Payload |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | SelfExtractingRAR |
|---|---|
| Author: | Xavier Mertens |
| Description: | Detects an SFX archive with automatic script execution |
| Rule name: | sfx_pdb_winrar_restrict |
|---|---|
| Author: | @razvialex |
| Description: | Detect interesting files containing sfx with pdb paths. |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Windows_Trojan_Remcos_b296e965 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.remcos. |
| Rule name: | win_xorist_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.xorist. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.