MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 60ee2a38836633f6887a2237c721492920a372eda1e26a8a0400f43bbfcf459b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 8
| SHA256 hash: | 60ee2a38836633f6887a2237c721492920a372eda1e26a8a0400f43bbfcf459b |
|---|---|
| SHA3-384 hash: | 37cf4352189d7f0c88c33c4a04acc1da9389c3b8e19e24e17c9a88444d106be9eea0ac9cd084daae8cdabff432590f8d |
| SHA1 hash: | a4c7c4e427077258800141ea43c26e4ff03d4ff8 |
| MD5 hash: | 384435e139c1571362282ad0f672bf27 |
| humanhash: | romeo-idaho-salami-ink |
| File name: | Galaxy Swapper v2.exe |
| Download: | download sample |
| Signature | njrat |
| File size: | 5'984'408 bytes |
| First seen: | 2025-05-14 14:35:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6a91eb82bfd19d2706c7d43c46f7064e (1 x njrat, 1 x NetSupport, 1 x Cobalt Strike) |
| ssdeep | 49152:YniOppBPQ5YTxj5a0uWc2iaURX7VmSkORCtN8+cGekZZVlw0p4+mU7iAl4jgxBBr:evPQ5s5nuWLbUNBmP8AflXeul1N |
| TLSH | T141568B126EB94B26D3AA1B30FCA23BF083B1A5536226E74E65C4D1A93C127754D113FF |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | 9299b86edef670b1 (1 x njrat) |
| Reporter | Anonymous |
| Tags: | exe NjRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
574
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Galaxy Swapper v2.exe
Verdict:
Malicious activity
Analysis date:
2025-03-08 23:10:08 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
81.4%
Tags:
dropper virus micro
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Verdict:
Suspicious
Labled as:
RiskWare[Obfuscator]/MSIL.Reactor
Verdict:
Suspicious
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Behaviour
Behavior Graph:
n/a
Score:
75%
Verdict:
Malware
File Type:
PE
Detection(s):
Malicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
60ee2a38836633f6887a2237c721492920a372eda1e26a8a0400f43bbfcf459b
MD5 hash:
384435e139c1571362282ad0f672bf27
SHA1 hash:
a4c7c4e427077258800141ea43c26e4ff03d4ff8
SH256 hash:
9b668c9ed6c99ecfe7df4d3b8ff1f19875761b217c01886a60a3f87e5329081d
MD5 hash:
0c100bbe31777ca8340af04185e731db
SHA1 hash:
c087e58f376b5464c49184a6c3b8e94d63d78fda
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
INDICATOR_EXE_Packed_DotNetReactor
SH256 hash:
4dd4d48e0681604e3a7a72b6eae42173421d0b806b1af8fa03b45d9999978499
MD5 hash:
c6115a08c8e50dac0194fb98d3edc9d2
SHA1 hash:
903da7fb7ad47b7ad8eb5984ed54a865f6148744
SH256 hash:
eb9b84a3df6ae51759544ba04224a4f91454b8a81d54b37c846a4216bc72c15e
MD5 hash:
319226c18dbc02d2ac4c0dd9dc116d53
SHA1 hash:
4ef827ec4c51cf2845e3a50fc23700177a4930f8
SH256 hash:
22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
MD5 hash:
adf3e3eecde20b7c9661e9c47106a14a
SHA1 hash:
f3130f7fd4b414b5aec04eb87ed800eb84dd2154
SH256 hash:
c26801c63fe1c35bb499b22e6f2dcfd3e2620786e7a5dbecaa7ee7dbda2180c9
MD5 hash:
2fc18227eb8e7535851208490603a90e
SHA1 hash:
482e5dd3065ddad6c34f08b91f2bc3e5ab1a2566
SH256 hash:
539f5d60cbc83535dd9ebb1d370d627413903b47f09d0ecdf82a4fe6ad8b979e
MD5 hash:
3a6b71c2a8f4c8c8636333466ad3af29
SHA1 hash:
0e115996f5c629e78fab85e230c14b8059d0b9a2
SH256 hash:
df543d3df8bd00d72e5eb2b9b2a15e67a6e4d10c13834de4cedbf500b8793e01
MD5 hash:
cd832cc791e31c0e77536fc034f36cf0
SHA1 hash:
20856671f0debe122e192821f92d24207377b800
SH256 hash:
fe02a7c70b0669b0e0449bf605d090be868eff0b11556db3156ec3d9834c47c6
MD5 hash:
5c857c5926b0e7fce94fa5301759e49d
SHA1 hash:
477a1d5941d796e784feb93caad41e54db3aac03
SH256 hash:
dfb89838975892ce84d906bf350e0dca0310d39a65b1ea02d8ad6cf1ce6ce566
MD5 hash:
0a79422c3ff37e84d3f951fa800e56ff
SHA1 hash:
5dc3dc8ce5be6fb32725d3c9c53088ae96a5ff1e
SH256 hash:
963bd567bfb88ec6d0b360ca12335bfd9f489666451363824a0d9804909791d5
MD5 hash:
c11d762b081f5351a44a80d9d4c379e2
SHA1 hash:
fa2cbc98556b8a4f7b9a82c446af39df925bedd1
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
SH256 hash:
e6738a9b5a8dc5797de59020e9dfeb524cc84f9ed015966337534a87830d56c7
MD5 hash:
4e12b7db3a56b40cbbce00271b693d77
SHA1 hash:
223633eb50c292d8c19172fd72ebdd2481a4ce25
SH256 hash:
e91705ee4b7abac7fbce0ea73f903811449dee3e9bcb591985a84ef41afa3db1
MD5 hash:
cf579c8c64b7485dc9d9dc0c84c99eb5
SHA1 hash:
0ec0b7d7e93b130bd63301d7d437d958409d7452
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
SH256 hash:
091c944f2db95521f9190319173f17848d515da8f5a2374a0ab680406ba65914
MD5 hash:
bd86598613f23b58a5e11ce0023fb14a
SHA1 hash:
3fdfc27d65d4c271f40af0bebc88b894de83b2f8
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DotNet_Reactor |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | grakate_stealer_nov_2021 |
|---|
| Rule name: | INDICATOR_EXE_Packed_DotNetReactor |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with unregistered version of .NET Reactor |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETDLLMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | PureCrypter |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies PureCrypter, .NET loader and obfuscator. |
| Reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | win32_dotnet_obfuscate |
|---|---|
| Author: | Reedus0 |
| Description: | Rule for detecting .NET obfuscated malware |
| Rule name: | win_rat_generic |
|---|---|
| Author: | Reedus0 |
| Description: | Rule for detecting generic RAT malware |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (FORCE_INTEGRITY) | high |
| CHECK_TRUST_INFO | Requires Elevated Execution (level:requireAdministrator) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteW |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryA |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::GetWindowsDirectoryW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegGetValueW ADVAPI32.dll::RegOpenKeyExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.