MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09
SHA3-384 hash: 5590b2bb82df7c9c06ac050628767b1f58f7272b897d7ae437351cf4193c907c6f9119ef9b8d902f9755ec3a24ea8c2c
SHA1 hash: 50dd587b873429f42136fdda562ef23d30359075
MD5 hash: 8db1db60c21403c4e1852638b856e6fe
humanhash: music-mexico-bluebird-purple
File name:EW0h6nyQB0E4QEJ.exe
Download: download sample
Signature njrat
Create hunting rule
File size:470'528 bytes
First seen:2025-12-05 14:15:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:TlTQmPoHsk94dzCFfxTQu/F5pVcDCwXoxLWHZdPjUNE:pQmY3mGFfxDnYCLW55wNE
TLSH T12CA412285698C917E9B507B00A31F370177ABE9EE822D317CEED5DEFB425B602904793
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
45.153.34.118:9878

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.153.34.118:9878 https://threatfox.abuse.ch/ioc/1668049/

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/23043c96-60c2-4f6d-9c82-0cda111d6961/
Malware family:
njrat
Create hunting rule
ID:
1
File name:
EW0h6nyQB0E4QEJ.exe
Verdict:
Malicious activity
Analysis date:
2025-12-05 14:20:29 UTC
Tags:
rat njrat bladabindi remote backdoor
Link:
https://app.any.run/tasks/cdddc3e3-d598-48ba-9442-621bf3cde1e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42657/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6932e8fc2b2823e41e748c85
Tags:
bladabindi njrat
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed vbnet
Link:
https://www.filescan.io/uploads/6932e8fbbba50eaf04231916/reports/647ef705-f631-420b-b322-b917e3763b5a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-05T13:00:00Z UTC
Last seen:
2025-12-06T03:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/75d5d212-85f8-4da3-9e43-c12acbbeafc0
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1827260
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/8db1db60c21403c4e1852638b856e6fe
Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-12-05 14:15:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3yejf2ggf4q7f63gnh4ljpziu66zyakmywbaonkjdrcm5e76b4eq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
error
njrat
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:nyan cat discovery trojan
Link:
https://tria.ge/reports/251205-rkrezssmh1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
45.153.34.118:9878
Verdict:
Unknown
Tags:
njrat Bladabindi
YARA:
n/a
Link:
https://app.threat.zone/submission/8de32822-8067-4dab-81c7-e15a7f503c48
Unpacked files
SH256 hash:
de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09
MD5 hash:
8db1db60c21403c4e1852638b856e6fe
SHA1 hash:
50dd587b873429f42136fdda562ef23d30359075
Link:
https://www.unpac.me/results/c36bd4ef-ebfc-418f-8fb9-6ca4379e2b45/
SH256 hash:
65ff3c159e0d6207aca43001079c062646d480ff9558454ac5666d5c0921ff70
MD5 hash:
2cc742abf147d316fb4243482b739fa7
SHA1 hash:
768f08baf401a952f2eb27cb0e9476d34a48f05b
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/c36bd4ef-ebfc-418f-8fb9-6ca4379e2b45/
Parent samples :
6e2b1a9ba0fb924774b35d3fe97e5ee232de78f7292fd7a79c678d6de974751a
d4ac4a98170b7b5606fc03e625be2973bd0f4ad38c653ba4db1558fead88dc0a
f50d4bf5151fc2f9f89ff48f4ead9ea615bc85a951b88a6d83d0dd53bd17a942
e3733d68078f927a67479fded197bf45287c17a775da4c81d3b3d4853e57d1f4
bfe8597cf704cb576063e7883146c8af4f384521ddc1ecb059d91d58480bc265
0b67d298c72d5ce44862870a253e2fae7011e9bb615b4edb17fee6227f252819
ffe62ce01381e57eeed388498cce63803de8f7a9093d0c9b8ff821179d65aeee
de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09
549a2ef27e60dc1550032622ce3c85b5b5b3fdceabdfc318342f1c24e55614bf
50aef9fefe23240506ef807c00fd6cd89ef912d98127db467bdb0823a3677721
SH256 hash:
4e761d8adda942508de3100568fccdb7bacbd640b362223c853cdaaae0f05873
MD5 hash:
c6e9833145970cd18212b1951ccc58e8
SHA1 hash:
879ffc7cd95837bab5864085b69d54c9fce38d06
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c36bd4ef-ebfc-418f-8fb9-6ca4379e2b45/
SH256 hash:
9463d0ff8dc567cb32ca7e0d52bd431ae25b51a72fc789430f03ec2f829ba3ba
MD5 hash:
4cc290b5aba415fe8abf05a92b8cdfe1
SHA1 hash:
ea64e3023163856833c16d7320be8880a71b94b0
Detections:
win_njrat
Create hunting rule
win_njrat_bytecodes_V2_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/c36bd4ef-ebfc-418f-8fb9-6ca4379e2b45/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de0892e8c62f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42657/

Comments