🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
SHA3-384 hash: c4031a437ffe9fbb2e44bc188593a3eb94d4b38900a5418b1fff5d3bd3cb9af49fe9cd960fdeb4fe85025e2aebb223fa
SHA1 hash: 0af5282708f6083ca96b8d648e7bc64303c7e4b5
MD5 hash: c991971668a76519b820782c87f99547
humanhash: venus-carolina-florida-friend
File name:4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
Download: download sample
Signature njrat
Create hunting rule
File size:97'404 bytes
First seen:2026-11-12 13:59:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 1536:8rjOduGOvffiy5xMjveRo6QJ2uhOFzr+WO3En6fH3KZoXKjtckmW1MbwMHF:mYuGOvffiIxtRoKzS73VaZoaJBmOMbrF
TLSH T1FC9312D5F3E84206FF6D8B3C9C7297A1673CF28254A3DE1758C881959D30391B80A57A
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Threatray
Tags:exe Ky9Agent NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 14:49:42 UTC
Tags:
smb auto-reg auto-startup auto-sch
Link:
https://app.any.run/tasks/6921eba6-62be-4fb3-af1c-7279bf5478b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99622/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af5c654ed14d027dfb56848
Tags:
injection autorun adapter ordin
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a file in the %temp% directory
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Connection attempt
Creating a process from a recently created file
Searching for synchronization primitives
Sending a custom TCP request
Launching a process
Launching a service
Creating a file in the system32 subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a single autorun event
Creating a file in the mass storage device
Enabling autorun
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Adding exclusions to Windows Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 masquerade obfuscated overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6af5c62bd78ba865d0cc449d/reports/3a3a3416-e418-4415-aa27-1a2c76646155/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ed89c972-bf1a-414e-acf0-7e9087f160bc
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004753
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to create processes via WMI
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates multiple autostart registry keys
Creates processes via WMI
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
May drop file containing decryption instructions (likely related to ransomware)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2004753 Sample: 2fcfHeimO7.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 79 Malicious sample detected (through community Yara rule) 2->79 81 Antivirus detection for dropped file 2->81 83 Antivirus / Scanner detection for submitted sample 2->83 85 6 other signatures 2->85 7 2fcfHeimO7.exe 9 71 2->7         started        12 svc_054249ebdadc.exe 2->12         started        14 wine70089.exe 2->14         started        16 6 other processes 2->16 process3 dnsIp4 73 192.168.2.100 unknown unknown 7->73 75 192.168.2.101 unknown unknown 7->75 77 98 other IPs or domains 7->77 55 \Device\Mup\192.168.2.5\...\winf979cc.exe, PE32 7->55 dropped 57 \Device\Mup\192.168.2.5\...\winf8d2b8.exe, PE32 7->57 dropped 59 \Device\Mup\192.168.2.5\...\winf2ee51.exe, PE32 7->59 dropped 65 63 other malicious files 7->65 dropped 101 Creates an undocumented autostart registry key 7->101 103 May drop file containing decryption instructions (likely related to ransomware) 7->103 105 Found many strings related to Crypto-Wallets (likely being stolen) 7->105 125 3 other signatures 7->125 18 RuntimeHost.exe 7->18         started        21 winf16209.exe 7->21         started        23 schtasks.exe 7->23         started        29 13 other processes 7->29 61 \Device\Mup\192.168.2.5\...\wineb0ca9.exe, PE32 12->61 dropped 67 33 other malicious files 12->67 dropped 107 Connects to many different private IPs via SMB (likely to spread or exploit) 12->107 109 Connects to many different private IPs (likely to spread or exploit) 12->109 111 Opens network shares 12->111 25 WMIC.exe 12->25         started        27 RuntimeHost.exe 12->27         started        31 4 other processes 12->31 69 4 other malicious files 14->69 dropped 113 Creates files in the system32 config directory 14->113 115 Creates multiple autostart registry keys 14->115 117 Creates an autostart registry key pointing to binary in C:\Windows 14->117 119 Adds extensions / path to Windows Defender exclusion list (Registry) 14->119 33 3 other processes 14->33 63 \Device\Mup\192.168.2.5\...\winf16209.exe, PE32 16->63 dropped 71 2 other malicious files 16->71 dropped 121 Antivirus detection for dropped file 16->121 123 Multi AV Scanner detection for dropped file 16->123 35 4 other processes 16->35 file5 signatures6 process7 signatures8 87 Antivirus detection for dropped file 18->87 89 Multi AV Scanner detection for dropped file 18->89 91 Creates files in the system32 config directory 21->91 93 Opens network shares 21->93 37 conhost.exe 23->37         started        95 Contains functionality to create processes via WMI 25->95 97 Creates processes via WMI 25->97 39 conhost.exe 25->39         started        99 May drop file containing decryption instructions (likely related to ransomware) 27->99 41 conhost.exe 29->41         started        43 conhost.exe 29->43         started        47 11 other processes 29->47 49 4 other processes 31->49 45 conhost.exe 33->45         started        51 2 other processes 33->51 53 4 other processes 35->53 process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.27 Win 32 Exe x86
Link:
https://app.malva.re/file/c991971668a76519b820782c87f99547
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b/
Threat name:
Win32.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2026-11-07 19:31:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j2qtur7dztgzx7we6fpmjojm4ualtf5stq645okjup5g5rpxk5fq._file
Verdict:
malicious
Label(s):
Ky9Agent
Create hunting rule
Link:
https://reports.threatray.com/d07d9d05-d176-4169-a6a7-a95fed974222
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/261112-rahp4agy5w/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
Windows security bypass
Windows security modification
Adds policy Run key to start application
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader rat sandbox_escape evasion
YARA:
sandboxdetect_misc BlacklistSandbox
Link:
https://app.threat.zone/submission/5b04673a-4021-4057-ac4f-39985d0d825a
Malware Family:
msilheracles
Create hunting rule
Malicious:
True
Tags:
polymorphic dotnet file-overlay exe obfuscated usb-check debug-check persistence
Link:
https://intel.virussign.com/intelligence/file/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
Unpacked files
SH256 hash:
4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b
MD5 hash:
c991971668a76519b820782c87f99547
SHA1 hash:
0af5282708f6083ca96b8d648e7bc64303c7e4b5
Link:
https://www.unpac.me/results/484b815a-c974-45eb-8a94-5fe9ab41e813/
SH256 hash:
0152654aee0d5b56524103b3e6babdefa3ce1192faf3e4c7acd21ac1fe75ec6e
MD5 hash:
5ef40adc1ca64bc11c79740313dfa8c0
SHA1 hash:
1150a65e5fc500578d97b2282806ec50e59f5b1e
Link:
https://www.unpac.me/results/484b815a-c974-45eb-8a94-5fe9ab41e813/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://x.com/ThreatrayLabs/status/2120871740024684884
Cape
Cape
https://www.capesandbox.com/analysis/99622/

Comments