MAL_Java_RAT_Jul26_2

Rule Info

Name
MAL_Java_RAT_Jul26_2
Author
Arnim Rupp
Description
Detects Java Class of a RAT, seen being used by BlackSuit ransomware gang
Score
80
Reference
https://www.rapid7.com/blog/post/2025/06/10/blacksuit-continues-social-engineering-attacks-in-wake-of-black-bastas-internal-conflict/
Date
2026-07-06
Minimum Yara
3.5.0
Rule Hash
517ee3ce02f1a40882e20a7801e9be7d
Tags
['RANSOM', 'CRIME', 'FILE', 'MAL']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/mal_java_rat_jul26_2/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
4
Clean (0 engines)
19

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-08-31 07:18:45
0
47
3c2e0abe9e4ee34888a0639cea65d3789e2aa9849c1be182c1497c2548c5e68b
2026-08-31 07:15:35
0
61
f7c559132437830991f44703e94f0b863f39a24bfedd27ed7dfbeba2696561df
2026-08-31 06:32:25
0
61
007ea27c2c231e6fb2254ed350da393b0693ac87490521ce96f3028c0ab444ae
2026-08-31 06:31:17
0
61
ec9989a0b624d480b726537b137ba8d4419ed8cdf219eb280cbad408f596e5c2
2026-08-31 06:31:17
0
61
a09c0b6ef0b7cd4bd9e2c08ab01295b9fff718445ccd96cee385c87f6b64ae86
2026-08-31 06:31:06
1
61
043a00b9effc792e1de9b7322fc5ed9fb20f724c9335a73862ff89643f5a95b5
2026-08-31 06:31:00
0
61
e74faed4a22e6b6f2e89a01dae2f06c9a94182ee965dad6e1a38f9266a8a40ae
2026-08-30 06:31:28
1
61
3f178b8e9b2fefb33ffc267a2538f7eb4d9b48335d8a7b8564cd6ac78360834c
2026-08-30 06:31:15
0
61
6ac4d43c0c2b5c85e55588e48206da683248ffa9724b192e7e1aac6814524265
2026-08-30 06:29:35
0
61
1f8226b1ed0280db71ada232fa505b77c7c43fda77c367f2b05fbd0e8eed8a70
2026-08-30 06:29:35
0
61
264f916f8a45857e3cbbd86f51b432a42face4bc874aebe6c9c3ecc428e4c474
2026-08-30 06:29:26
0
61
290c23f29d97a9a1fab7202be92052ac0d6a7fbb43dfc5565a1364d133b32ef6
2026-08-30 05:52:55
0
61
88c16b6d9d38e3accc7f4eb702e78b53b9334e4f43409cb92134dd756a1af228
2026-08-30 05:52:55
0
61
3ee9c664b877a60b3bbc0d99671ee0a23a284db4f981cf35f2a312624365d115
2026-08-30 05:52:46
0
61
9087381585ef4a7170a4baeb80fb801cd33e20e251a966e787f958ae11cd1e1e
2026-08-30 05:52:46
0
62
b36f522b7fda88f76c30c197f94f338576c61a197c232ce5905b92d1b10d7c2f
2026-08-30 05:52:36
0
61
712eb5039baed1d23ca0faebce1ed13ce5bab2524fc5928552fad892450359a3
2026-08-30 05:52:18
0
61
e0cc9ed9c6dd65bf3699d06baec53309bd17b96d8b7a304968d6393a359bd00c
2026-08-30 05:52:06
0
61
55077f3cd57df88a98f973f6afc39f8df9d298c980d8bc0ba30d03194bb04ffd
2026-08-30 05:51:06
0
59
ca2322c32a2fbb0f1faa4db9cfd7690986f2c6f35c3b7ec9e443f1bca2b10e75
2026-08-30 05:50:57
1
61
3ccd4b8e510e1180d08a5fdc9464282349320d17b0e463822cde65a8ac1c349c
2026-08-30 05:50:45
0
61
74a50fc575a06d0b4a5577b70287f4fd3d83c519eb251fdc92eb0cfa289d8c85
2026-08-30 05:50:45
1
61
1c4fef9d60869109b16f03056bc05267660a4ab48c586c4f755a164426665787

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022