MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
SHA3-384 hash: 6d5fe456b07f2a151cbb67fc629604ddb71127f29f797e4a91759d39f58fe2a7b180dff7579a3a1f3967e0ff5310a1ec
SHA1 hash: 46c9090f45a74b0e2fd54ab0b70b2250f9bd1271
MD5 hash: 663da4a53a92bbf3688ef7d91bf3fc4f
humanhash: king-football-yankee-twelve
File name:5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
Download: download sample
Signature njrat
Create hunting rule
File size:869'888 bytes
First seen:2026-08-10 13:27:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'192 x AgentTesla, 20'344 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 12288:L/PNKL9lQWENV39tdbMlqJ05w8evudkglK6hFhR9KbHiZagI6nFP0h:RHdDdjCwSdkR6hZAK5I61q
TLSH T11205E0D03739BB05DEB41A319974EEB583B92DA9B420F9D61ED93B9B346D2005E0CF12
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/de3749ff-d725-40d1-b5d6-b60429ac9d58/
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79507/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context explorer formbook krypt lolbin packed
Link:
https://www.filescan.io/uploads/6a79d2009319687c8f7bebb2/reports/2ee8d21a-664a-48f7-b415-2bb3ced2780c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-29T06:29:00Z UTC
Last seen:
2026-08-07T21:13:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/47b694f4-dc77-481e-a05a-15cf32531b9a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-06-29 10:02:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkg3vnhsizgvehhdluqlyhjniwtsi5xdmt7cuwtzwctoj2qnwm6q._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/5afb0409-b6da-4fb6-a633-ef913ee084de
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/260810-qrkeksvvdz/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Unpacked files
SH256 hash:
5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
MD5 hash:
663da4a53a92bbf3688ef7d91bf3fc4f
SHA1 hash:
46c9090f45a74b0e2fd54ab0b70b2250f9bd1271
Link:
https://www.unpac.me/results/3ecdaaa7-b1b6-469d-8f1a-524811c04c66/
SH256 hash:
bb55991148f85f97ef5cde54c6a41054f181cfd44469efe7aac32f85f52bbe59
MD5 hash:
f6862d3f48e8701320e49f0563e296db
SHA1 hash:
299fb64a6b044473dba39255751c456f49bdbea8
Link:
https://www.unpac.me/results/3ecdaaa7-b1b6-469d-8f1a-524811c04c66/
SH256 hash:
dba35191e45ee9541dc8eff39b6a31c730afd68d211356c5624d818d7091b615
MD5 hash:
53e1599dbde081dcfee49f3387afeebd
SHA1 hash:
2e51666d11f99aadf53444ad9e9aaa14bb2ea612
Link:
https://www.unpac.me/results/3ecdaaa7-b1b6-469d-8f1a-524811c04c66/
SH256 hash:
3f53c9b7b3d9655bef339d9107865ea1dbe4ca60d7299be6f9794a167800325c
MD5 hash:
ceb195dd3cfbd4b8c8167604c06cda75
SHA1 hash:
8d26735771bb5b23111e00e0c7f6072a7564e473
Link:
https://www.unpac.me/results/3ecdaaa7-b1b6-469d-8f1a-524811c04c66/
SH256 hash:
5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d
MD5 hash:
663da4a53a92bbf3688ef7d91bf3fc4f
SHA1 hash:
46c9090f45a74b0e2fd54ab0b70b2250f9bd1271
Link:
https://www.unpac.me/results/3ecdaaa7-b1b6-469d-8f1a-524811c04c66/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79507/

Comments