🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217
SHA3-384 hash: 6451c30a79f63206b2976b682d0639a76ee4c8c1f94da7cc5a32ed8c95fbe9fb16807919007ad314d215f2feb4c02c51
SHA1 hash: 27d9e87665efd24b345723aeaa080587df2bce7c
MD5 hash: 4550d9b5f756bd1d893ebe3ce4e91f6f
humanhash: charlie-cardinal-yellow-victor
File name:4550D9B5F756BD1D893EBE3CE4E91F6F.exe
Download: download sample
Signature njrat
Create hunting rule
File size:1'952'256 bytes
First seen:2025-09-17 07:05:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (259 x Neshta, 15 x AgentTesla, 15 x Formbook)
ssdeep 24576:OW1NOApgT19z9LcxgBvmcVs/rvoiXdIb8ZKA/Cn:OW1NOApgT19z9LnscVsDQiXdIbFXn
TLSH T14E95B509FAF2AA21CA1C0977D337E93C4397610D3F02D1D9669A26462F5A7EDCDC740A
TrID 86.8% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
3.4% (.EXE) Win64 Executable (generic) (10522/11/4)
3.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.4% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
115.92.155.19:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
115.92.155.19:81 https://threatfox.abuse.ch/ioc/1593292/

Intelligence

File Origin
# of uploads :
1
# of downloads :
345
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4550D9B5F756BD1D893EBE3CE4E91F6F.exe
Verdict:
Malicious activity
Analysis date:
2025-09-17 07:12:11 UTC
Tags:
neshta
Link:
https://app.any.run/tasks/fa86b7d7-b944-4891-894d-2ce6595c023a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27862/
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Packed.njRAT-7752919-1
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ca5dc4e579c633a4b5ee60
Tags:
dropper neshta virus sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file in the Windows directory
Modifying an executable file
Creating a file in the Program Files subdirectories
Сreating synchronization primitives
Creating a file
Creating a process with a hidden window
Creating a window
DNS request
Connection attempt
Unauthorized injection to a recently created process
Enabling autorun with the shell\open\command registry branches
Launching the process to change the firewall settings
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Infecting executable files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
borland_delphi fingerprint neshta overlay overlay packed virus
Link:
https://www.filescan.io/uploads/68ca5dcedbc6f5a29c493030/reports/ecafec0b-aa03-45ea-b1b9-55b0aed50cc3/overview
Verdict:
Malicious
Labled as:
Neshta.A
Link:
https://www.hybrid-analysis.com/sample/2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217
Verdict:
Malicious
File Type:
exe x32
First seen:
2021-05-29T22:49:00Z UTC
Last seen:
2021-05-29T22:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217/results?tab=lookup
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1080f439-ef9d-4047-9905-f79823e7be94
Result
Threat name:
Neshta, Njrat
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1779022
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Disables zone checking for all users
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
Drops PE files with a suspicious file extension
Drops PE files with benign system names
Found malware configuration
Infects executable files (exe, dll, sys, html)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sample is not signed and drops a device driver
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Uses netsh to modify the Windows network and firewall settings
Yara detected Neshta
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1779022 Sample: 2GoEDeX9lJ.exe Startdate: 17/09/2025 Architecture: WINDOWS Score: 100 57 waegwan.theworkpc.com 2->57 65 Suricata IDS alerts for network traffic 2->65 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 9 other signatures 2->71 11 2GoEDeX9lJ.exe 5 2->11         started        15 svchost.com 2->15         started        17 svchost.com 2->17         started        19 svchost.com 2->19         started        signatures3 process4 file5 47 C:\Windows\svchost.com, PE32 11->47 dropped 49 C:\Users\user\AppData\Local\Temp\chrome.exe, PE32 11->49 dropped 51 C:\Users\user\AppData\...\2GoEDeX9lJ.exe, PE32 11->51 dropped 53 137 other malicious files 11->53 dropped 87 Creates an undocumented autostart registry key 11->87 89 Drops PE files with a suspicious file extension 11->89 91 Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS) 11->91 95 2 other signatures 11->95 21 2GoEDeX9lJ.exe 4 5 11->21         started        93 Drops executables to the windows directory (C:\Windows) and starts them 15->93 25 dwm.exe 15->25         started        27 dwm.exe 17->27         started        29 dwm.exe 19->29         started        signatures6 process7 file8 43 C:\Windows\dwm.exe, PE32 21->43 dropped 45 C:\Users\user\AppData\...\2GoEDeX9lJ.exe.log, CSV 21->45 dropped 81 Multi AV Scanner detection for dropped file 21->81 83 Drops executables to the windows directory (C:\Windows) and starts them 21->83 85 Drops PE files with benign system names 21->85 31 svchost.com 1 21->31         started        signatures9 process10 file11 55 C:\Windows\directx.sys, ASCII 31->55 dropped 61 Multi AV Scanner detection for dropped file 31->61 63 Sample is not signed and drops a device driver 31->63 35 dwm.exe 4 2 31->35         started        signatures12 process13 dnsIp14 59 waegwan.theworkpc.com 115.92.155.19, 49721, 81 LGDACOMLGDACOMCorporationKR Korea Republic of 35->59 73 Multi AV Scanner detection for dropped file 35->73 75 Protects its processes via BreakOnTermination flag 35->75 77 Disables zone checking for all users 35->77 79 4 other signatures 35->79 39 netsh.exe 35->39         started        signatures15 process16 process17 41 conhost.exe 39->41         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/4550d9b5f756bd1d893ebe3ce4e91f6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2025-09-13 21:05:26 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fz6ufs63ck3ycqkxxnvsjjxgqk3gulqormuwtsxewnrdx3eksilq._file
Verdict:
malicious
Label(s):
neshta
Create hunting rule
njrat
Create hunting rule
Similar samples:
error
njrat
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:neshta family:njrat botnet:sys01 defense_evasion discovery persistence privilege_escalation spyware stealer trojan
Link:
https://tria.ge/reports/250917-hwz2tshn7t/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Modifies system executable filetype association
Reads user/profile data of web browsers
Modifies Windows Firewall
Detect Neshta payload
Neshta
Neshta family
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
waegwan.theworkpc.com:81
Verdict:
Malicious
Tags:
trojan neshta Win.Trojan.Neshuta-1 Bladabindi njrat
YARA:
EXE_Virus_Neshta_March2024 Windows_Virus_Neshta_2a5a14c8 MAL_Neshta_Generic MALWARE_Win_Neshta MAL_Malware_Imphash_Mar23_1
Link:
https://app.threat.zone/submission/d80fae32-cff0-4c3a-9747-9e3a2394281c
Unpacked files
SH256 hash:
2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217
MD5 hash:
4550d9b5f756bd1d893ebe3ce4e91f6f
SHA1 hash:
27d9e87665efd24b345723aeaa080587df2bce7c
Detections:
win_neshta_g0
Create hunting rule
Neshta
Create hunting rule
Link:
https://www.unpac.me/results/0f353ebf-1e71-4d74-af7d-a6d6a6a042fc/
Malware family:
Neshta
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2e7d42cbdb12/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e7d42cbdb12b7814157bb6b24a6e682b66a2e0e8b2969cae4b3623bec8a9217

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:EXE_Virus_Neshta_March2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MALWARE_Win_Neshta
Create hunting rule
Author:ditekSHen
Description:Detects Neshta
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:MAL_Neshta_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Neshta malware
Reference:Internal Research
Rule name:MAL_Neshta_Generic_RID2DC9
Create hunting rule
Author:Florian Roth
Description:Detects Neshta malware
Reference:Internal Research
Rule name:neshta_v1
Create hunting rule
Author:RandomMalware
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Virus_Neshta_2a5a14c8
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27862/

Comments