MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f23f0f4b55b95bd8a7b122769949edf4bd686aea35215286d1551d2c2dfe150c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Anonymous

Retrieved from https://raw.githubusercontent.com/CatGamesYT/TerrariaSetup/main/Terraria.rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

HU

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Terraria.exe
File size:	37'888 bytes
SHA256 hash:	a9d17bd42531c52bcc16e7424db420bb8c56834962cc04209f5d6f937eccff47
MD5 hash:	6dba8d29c2a91741248a0afe4d2d8370
MIME type:	application/x-dosexec
Signature	njrat

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/f23f0f4b55b95bd8a7b122769949edf4bd686aea35215286d1551d2c2dfe150c/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd explorer fingerprint keylogger lolbin lolbin netsh njrat rat replace stealer

Link:

https://www.filescan.io/uploads/65859a5ef4b6e5e16354ccb3/reports/10302477-b292-4bf0-be48-ab4cf7e00c12/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/f23f0f4b55b95bd8a7b122769949edf4bd686aea35215286d1551d2c2dfe150c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f23f0f4b55b95bd8a7b122769949edf4bd686aea35215286d1551d2c2dfe150c/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.NjRAT

Threat name:

ByteCode-MSIL.Trojan.NjRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-22 14:17:04 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

19 of 23 (82.61%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6i7q6s2vxfn5rj5rej3jsspn6s6wq2xkguqvfbwrkuosylp6cuga._file

Hatching Triage njrat

Result

Malware family:

njrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:njrat botnet:cheat evasion

Link:

https://tria.ge/reports/231222-sp6wxaahf4/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Legitimate hosting services abused for malware hosting/C2

Modifies Windows Firewall

Malware Config

C2 Extraction:

6.tcp.eu.ngrok.io:19960

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f23f0f4b55b95bd8a7b122769949edf4bd686aea35215286d1551d2c2dfe150c