MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 59264e23039aa0aa0c5c376715c0d353cef4e52e055bd0da423dc8d2abef127f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 15
| SHA256 hash: | 59264e23039aa0aa0c5c376715c0d353cef4e52e055bd0da423dc8d2abef127f |
|---|---|
| SHA3-384 hash: | a4b4eb23d74edd3420c791279849f64bc49a60a52aa96928307b7ec64468af71c1e364a0428c4c65683723fb84bb29ca |
| SHA1 hash: | 59a5714462c3ef2297d09aa740d4fe69250b16d5 |
| MD5 hash: | fd73caae0c2a48530a4bc25a4dc89bb3 |
| humanhash: | maine-golf-orange-four |
| File name: | NEW ORDER-AND-SPECIFICATIONS no. 01-144-26.-PDF.exe |
| Download: | download sample |
| Signature | njrat |
| File size: | 902'656 bytes |
| First seen: | 2026-02-02 16:51:17 UTC |
| Last seen: | 2026-02-02 17:27:50 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'013 x AgentTesla, 19'919 x Formbook, 12'332 x SnakeKeylogger) |
| ssdeep | 24576:O0Ucw59idqutSkr/6ynf6wJWjju6gokXSzr7CD:Gcw59YQ7C62J6gokXS |
| Threatray | 267 similar samples on MalwareBazaar |
| TLSH | T14115125832A9C76AD47B8BF88922D2702B74ADBEB810D60B5ECD7EDBB436704C415743 |
| TrID | 35.4% (.EXE) Win64 Executable (generic) (10522/11/4) 22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.1% (.EXE) Win32 Executable (generic) (4504/4/1) 6.9% (.ICL) Windows Icons Library (generic) (2059/9) 6.8% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter | Anonymous |
| Tags: | exe NjRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
173
Origin country :
USVendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
_59264e23039aa0aa0c5c376715c0d353cef4e52e055bd0da423dc8d2abef127f.exe
Verdict:
Malicious activity
Analysis date:
2026-02-02 16:53:12 UTC
Tags:
auto-startup susp-lnk
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Verdict:
Malicious
Score:
94.9%
Tags:
autorun keylog micro word
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Using the Windows Management Instrumentation requests
Setting a global event handler for the keyboard
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-02T13:57:00Z UTC
Last seen:
2026-02-02T14:21:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.WinLNK.Powecod.e Backdoor.MSIL.XWorm.c HEUR:Trojan-Spy.MSIL.Stealer.gen Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb PDM:Trojan.Win32.Generic
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.XWORM
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Status:
Malicious
First seen:
2026-02-02 16:50:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 24 (70.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xworm
Similar samples:
+ 257 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm discovery execution rat trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Xworm
Xworm family
Unpacked files
SH256 hash:
59264e23039aa0aa0c5c376715c0d353cef4e52e055bd0da423dc8d2abef127f
MD5 hash:
fd73caae0c2a48530a4bc25a4dc89bb3
SHA1 hash:
59a5714462c3ef2297d09aa740d4fe69250b16d5
SH256 hash:
77a22aa49513f0424017549f49bcf531c73e728d00d509fbb144b201ce4e0bcb
MD5 hash:
fab9060d31e97662094a2c13835d6418
SHA1 hash:
04b7d52b2d4cd289effe0f8b506367397dd6de0e
SH256 hash:
6711fb0a2eca0ac54d6755709dfc5faeabe700c34b9665bd2cc6b52eaa27ab00
MD5 hash:
0f9b8b8e4ac6aadc5d62044c48cf9b73
SHA1 hash:
084cd6e69daac4b442fe719c08e452878bda272a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SH256 hash:
6ca329964ec33eb078d5213644b7f9ba21b774156db2b915c7984e39a9db45dd
MD5 hash:
08faa81e5e9f47456ac7844a23fee204
SHA1 hash:
bff7bd06ccd5ffa48c8e0e0886e04e4937857b33
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.