de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe

Classification: Malicious

de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe is a malicious file sample. Linked to Njrat malware. Detected by 71 antivirus engines.

Detection summary

  • 71 antivirus detections
  • 0 IDS alerts
  • 2 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: NJRAT (S0385)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2025-06-23 06:00:13 2025-06-23 06:20:24
njrat MalwareBazaar Abuse.ch 2025-06-07 12:31:40 2025-06-07 12:31:40 malicious-activity S0385 njRAT

Tags

evasive malicious njrat umbrella winnti

Sample information

Filenames
de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe, 60fecc0486c6d9b7da28cd4be010e6f2.exe
File type
application/x-dosexec
Size
32256 bytes
MD5
60fecc0486c6d9b7da28cd4be010e6f2
SHA-1
a1471f558fcaf238b51f671a589771293a2adfbe
SHA-256
de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925
First indexed
2025-06-07 13:21:06
Last updated
2026-09-03 01:03:50

Antivirus detections

EngineDetection
ALYacGen:Variant.Jalapeno.1929
APEXMalicious
AVGMSIL:Bladabindi-JK [Trj]
AhnLab-V3Trojan/Win32.Bladabindi.R130484
AlibabaBackdoor:MSIL/Bladabindi.e2027c71
Antiy-AVLTrojan[Backdoor]/MSIL.Bladabindi.as
ArcabitTrojan.Jalapeno.D789
AvastMSIL:Bladabindi-JK [Trj]
AviraTR/Dropper.Gen7
BaiduMSIL.Backdoor.Bladabindi.a
BitDefenderGen:Variant.Jalapeno.1929
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.GenericFC.S20328680
CTXexe.trojan.bladabindi
ClamAVWin.Packed.Generic-9795615-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebBackDoor.Bladabindi.15771
ESET-NOD32a variant of MSIL/Bladabindi.AS
ElasticWindows.Trojan.Njrat
EmsisoftGen:Variant.Jalapeno.1929 (B)
F-SecureTrojan.TR/Dropper.Gen7
FortinetMSIL/Bladabindi.AS!tr
GDataMSIL.Trojan-Spy.Bladabindi.BQ
GoogleDetected
GridinsoftRansom.Win32.Bladabindi.sa
IkarusBackdoor.MSIL.NJRat
JiangminTrojanDropper.Autoit.dce
K7AntiVirusTrojan ( 700000121 )
K7GWTrojan ( 700000121 )
KasperskyHEUR:Trojan.Win32.Generic
Kingsoftmalware.kb.c.1000
LionicTrojan.Win32.Generic.lA1H
MalwarebytesBladabindi.Backdoor.Bot.DDS
MaxSecureTrojan.Malware.300983.susgen
McAfeeDReal Protect-LS!60FECC0486C6
MicroWorld-eScanGen:Variant.Jalapeno.1929
MicrosoftBackdoor:MSIL/Bladabindi
NANO-AntivirusTrojan.Win32.Gen8.ecsqgn
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingBackdoor.njRAT!1.9E49 (CLASSIC)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.BackdoorNJRat.nm
SophosMal/Bladabi-D
SymantecMSIL.Trojan!gen2
TACHYONBackdoor/W32.DN-NjRat.32256
TencentTrojan.Msil.Bladabindi.cg
Trapminemalicious.high.ml.score
TrellixENSBackDoor-NJRat!60FECC0486C6
TrendMicroBackdoor.Win32.NJRAT.YXFFDZ
TrendMicro-HouseCallBKDR_BLADABI.SMC
VBA32Trojan.MSIL.Bladabindi.Heur
VIPREGen:Variant.Jalapeno.1929
VaristW32/MSIL_Bladabindi.A.gen!Eldorado
ViRobotTrojan.Win.Z.Bladabindi.32256.DOL
VirITBackdoor.Win32.Bladabindi.XIP
XcitiumBackdoor.MSIL.Bladabindi.BA@7oej5x
YandexTrojan.AvsMofer.dd6520
ZillyaTrojan.Generic.Win32.817952
ZoneAlarmMal/Bladabi-D
ZonerTrojan.Win32.85838
alibabacloudRansomWare:MSIL/Bladabindi.AS
huorongBackdoor/Bladabindi.e
AlibabaBackdoor:MSIL/Bladabindi.a63fdbee
K7AntiVirusTrojan ( 700000201 )
K7GWTrojan ( 700000201 )
SkyhighBehavesLike.Win32.Trojan.nm
alibabacloudBackdoor:MSIL/Bladabindi.AB

Network contacts

209.25.140.16

DNS requests

photographers-ecological.with.playit.plus

Process list

NameCommand line
de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe
netsh.exenetsh firewall add allowedprogram "C:\de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe" "de7ce0b4b98abcfcaa736f28f3abce6a4ecc4dc5083bac5c1ef3d3b821618925.exe" ENABLE