MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
SHA3-384 hash: 746cdfc031925632d72e5b8bc883ffcff6201277bc36ef7ce7ae772e5f21d1a6292907ae277a6997d7ca8e15eee01135
SHA1 hash: 50e41303205b2ded9f95435ad5fd2ef928fc1454
MD5 hash: ea9d1eb976a0c3f31af8135b1c866f40
humanhash: ceiling-october-jupiter-golf
File name:17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
Download: download sample
Signature njrat
Create hunting rule
File size:891'392 bytes
First seen:2026-08-10 13:27:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'191 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:V1BaXrAQVIKQDTNDPNKWuJBuBpHESQDo/O1:VK0EIK85PNXuJBOHESV/O
TLSH T1E11501C03B39B71ADE5516349534EEB501FA2DA8B011F9E26EEC7B4B75AE200AD0CF51
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 08786464d8d060a8 (5 x Formbook, 1 x RemcosRAT, 1 x AgentTesla)
Reporter adrian__luca
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/08106915-7579-41fd-bc30-c6b6892e2563/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79511/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context packed vidar
Link:
https://www.filescan.io/uploads/6a79d1f49319687c8f7beb88/reports/cd19c688-278d-48c8-9811-1c62213a341e/overview
Verdict:
Malicious
Labled as:
IL:Trojan.Vidar
Link:
https://www.hybrid-analysis.com/sample/17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5cc98d4-9c26-4258-a86a-a28f5173d2fc
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa/
Threat name:
ByteCode-MSIL.Trojan.Vidar
Create hunting rule
Status:
Malicious
First seen:
2026-08-10 13:32:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7ifsjdr3ijsmswc7og3axwmpukp7xfvbyyw3pwldwl6wfc7j35a._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/ec2509af-35fe-4a7d-b29f-e480fa3272c8
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/260810-qrmjyavvfs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Unpacked files
SH256 hash:
17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
MD5 hash:
ea9d1eb976a0c3f31af8135b1c866f40
SHA1 hash:
50e41303205b2ded9f95435ad5fd2ef928fc1454
Link:
https://www.unpac.me/results/9f20615b-b92c-4c94-ba5b-87fbb4f92b5b/
SH256 hash:
17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa
MD5 hash:
ea9d1eb976a0c3f31af8135b1c866f40
SHA1 hash:
50e41303205b2ded9f95435ad5fd2ef928fc1454
Link:
https://www.unpac.me/results/9f20615b-b92c-4c94-ba5b-87fbb4f92b5b/
SH256 hash:
bb55991148f85f97ef5cde54c6a41054f181cfd44469efe7aac32f85f52bbe59
MD5 hash:
f6862d3f48e8701320e49f0563e296db
SHA1 hash:
299fb64a6b044473dba39255751c456f49bdbea8
Link:
https://www.unpac.me/results/9f20615b-b92c-4c94-ba5b-87fbb4f92b5b/
SH256 hash:
75888de503f00a4496d85d61ca30ea79c0a98f377ed109a8a5f85952d5f73e7f
MD5 hash:
b7750c756b21358f21181f9797f2bb77
SHA1 hash:
6bca78f53641b02607e78b370511fd4c2804bfea
Link:
https://www.unpac.me/results/9f20615b-b92c-4c94-ba5b-87fbb4f92b5b/
SH256 hash:
3f53c9b7b3d9655bef339d9107865ea1dbe4ca60d7299be6f9794a167800325c
MD5 hash:
ceb195dd3cfbd4b8c8167604c06cda75
SHA1 hash:
8d26735771bb5b23111e00e0c7f6072a7564e473
Link:
https://www.unpac.me/results/9f20615b-b92c-4c94-ba5b-87fbb4f92b5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79511/

Comments