MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 15

Intelligence 15 IOCs YARA 11 File information Comments

SHA256 hash:	01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3
SHA3-384 hash:	686b9735a0822ab180f0988d2678af8cbc1e3998ea2740777e4ae22bbb8dc5a7a53b0d53e86a51a90d75c3fa28ec49ce
SHA1 hash:	2993998d4dfbc795a827c1c4e00b6b0d11344a3c
MD5 hash:	a5ed87a4bedca67cd15810633227c162
humanhash:	pasta-speaker-lima-juliet
File name:	01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3
Download:	download sample
Signature	njrat Create hunting rule
File size:	585'728 bytes
First seen:	2025-08-12 15:01:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep	12288:Bg2l4S2PaXl+QSqvLAmQrMuakwgKluTlLRNJ6/G95t8I:u2KBDPqvLAmSMzkEljux8I
TLSH	T1E3C4DF0036B98F02C8AB97F45570E1B107F47EAEAA10D34E8EE57DDB7675B814A80B53
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	d8d8dadad9d999d8 (8 x Formbook, 4 x SnakeKeylogger, 4 x AgentTesla)
Reporter	adrian__luca
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

156

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3

Verdict:

Malicious activity

Analysis date:

2025-08-13 00:39:35 UTC

Tags:

auto-startup remote xworm

Link:

https://app.any.run/tasks/ede7f22a-3a41-4a95-96e4-42fa74ddf4a8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/20915/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b5c3cc633abe3908e57d9

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Creating a process with a hidden window

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint formbook obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/689b79562fbe0788fb1e71da/reports/2711ca10-3370-45e9-a44a-ce540541893a/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3

Malware family:

KeyBase

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0e63f73f-a5f7-41db-8fce-7684a7f7fcca

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3

Gathering data

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-07-31 04:59:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ah3awv7dxlkixrcklqufrzehcak4xwm7b44iiuxg5bx5yqezvorq._file

Verdict:

malicious

Label(s):

xworm

unc_loader_037

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm collection discovery execution rat spyware stealer trojan

Link:

https://tria.ge/reports/250812-vw74nafq6t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Drops startup file

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Detect Xworm Payload

Xworm

Xworm family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f14753e7-0bc1-4ef0-be82-d2ff947cb744

Unpacked files

SH256 hash:

01f60b57e3bad48bc44a5c2858e4871015cbd99f0f388452e6e86fdc4099aba3

MD5 hash:

a5ed87a4bedca67cd15810633227c162

SHA1 hash:

2993998d4dfbc795a827c1c4e00b6b0d11344a3c

Link:

https://www.unpac.me/results/4cc586e7-6f67-4bb6-b7d4-056be16decda/

SH256 hash:

6f1b8dc5b633ef7ce24d6f095bb1c24b3ff8a435e66725336453079c2ed84d1e

MD5 hash:

c790732f5591379636ab688538070683

SHA1 hash:

355a1e6815f3b836d67b05fde307b8b354069145

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/4cc586e7-6f67-4bb6-b7d4-056be16decda/

SH256 hash:

8a09f15b3fd6aaa10542a9323338585699439522a2fc9f1d7060432dbe04808a

MD5 hash:

3812f5aae46a1525ca63e4517a87ead1

SHA1 hash:

77e8dbb5c7f5bc747d63f886b5a167dc1c751dbd

Link:

https://www.unpac.me/results/4cc586e7-6f67-4bb6-b7d4-056be16decda/

SH256 hash:

6005f0e4563fef5e8abfdb88cacd5b3d8fd4cff04b1af93e8e01a9990f46d5c0

MD5 hash:

3f17ed370489371093c2a3d768cb6b07

SHA1 hash:

fb4f0ddcaf872e4c7850e4cefad59a2c62f54424

Link:

https://www.unpac.me/results/4cc586e7-6f67-4bb6-b7d4-056be16decda/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/01f60b57e3ba/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Trojan_XWorm_b7d6eaa8 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20915/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample