MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
SHA3-384 hash: eeb0735263bc4435b85a20652a860a13757eb333558306e41fff866a87fca3a1072fe5e994dd4059c4273024061cc2e6
SHA1 hash: fd200068f17ec2e98ce189c620ed3d4ed0de053f
MD5 hash: 12c8d52ed18e13a2fe290565376bffd4
humanhash: three-sweet-leopard-maine
File name:Vp4R7KZ.exe
Download: download sample
Signature njrat
Create hunting rule
File size:168'448 bytes
First seen:2025-08-12 14:30:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:QbaQW/FUmtncdrMAPU7BnNhSRLH3tvCEkEjOV5oc0Fb3O7x6:QbaGz871a1dawy7oHb+7
Threatray 187 similar samples on MalwareBazaar
TLSH T1B1F3295A77898B10D5BC1D7190EB663003F19EC76633E7CA2F88359D8E112D7AE4C6CA
TrID 51.8% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
22.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.4% (.EXE) Win64 Executable (generic) (10522/11/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
196.251.73.249:6522

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
196.251.73.249:6522 https://threatfox.abuse.ch/ioc/1567695/

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 17:00:30 UTC
Tags:
auto-sch netreactor auto-reg auto-startup
Link:
https://app.any.run/tasks/48e17fe5-88f6-4972-b17e-bcd215ede871

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20689/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b531cfca70bd90e8f13b6
Tags:
bladabindi autorun njrat
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Creating a window
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2ace2ac3-eb3c-4a8a-9941-3c46b82b1a6e
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1755419
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Disables zone checking for all users
Drops PE files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1755419 Sample: Vp4R7KZ.exe Startdate: 12/08/2025 Architecture: WINDOWS Score: 100 80 Suricata IDS alerts for network traffic 2->80 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 9 other signatures 2->86 8 Vp4R7KZ.exe 1 6 2->8         started        11 Vp4R7KZ.exe 2 2->11         started        14 svchost.exe 2->14         started        16 6 other processes 2->16 process3 dnsIp4 72 C:\Users\user\AppData\Roaming\ClientLI.exe, PE32 8->72 dropped 74 C:\Users\user\AppData\...\Vp4R7KZ.exe.log, ASCII 8->74 dropped 19 ClientLI.exe 8->19         started        24 taskkill.exe 1 8->24         started        26 taskkill.exe 1 8->26         started        34 4 other processes 8->34 96 Uses schtasks.exe or at.exe to add and modify task schedules 11->96 28 taskkill.exe 1 11->28         started        30 taskkill.exe 1 11->30         started        36 4 other processes 11->36 98 Changes security center settings (notifications, updates, antivirus, firewall) 14->98 76 127.0.0.1 unknown unknown 16->76 32 schtasks.exe 16->32         started        38 7 other processes 16->38 file5 signatures6 process7 dnsIp8 78 196.251.73.249, 49724, 49726, 5000 Web4AfricaZA Seychelles 19->78 68 C:\Users\user\AppData\...\ClientLI.exe, PE32 19->68 dropped 70 C:\Users\user\AppData\...\tmp5E4A.tmp.exe, PE32 19->70 dropped 88 Antivirus detection for dropped file 19->88 90 Multi AV Scanner detection for dropped file 19->90 92 Moves itself to temp directory 19->92 94 3 other signatures 19->94 50 6 other processes 19->50 40 conhost.exe 24->40         started        42 conhost.exe 26->42         started        44 conhost.exe 28->44         started        46 conhost.exe 30->46         started        48 conhost.exe 32->48         started        52 4 other processes 34->52 54 4 other processes 36->54 56 7 other processes 38->56 file9 signatures10 process11 process12 58 conhost.exe 48->58         started        60 conhost.exe 50->60         started        62 conhost.exe 50->62         started        64 conhost.exe 50->64         started        66 2 other processes 50->66
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5/
Verdict:
Malicious
Threat:
HEUR:Trojan.Win32
Link:
https://tip.neiki.dev/file/841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2025-08-12 15:31:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqn2pajr7ksqqulu6i34a7vthjuogldxcyjt7erwl7rkrg2hzo2q._file
Verdict:
malicious
Label(s):
fantomcrypt
Create hunting rule
Similar samples:
001675222ff7d2737c791933a4e02d5dcf34a4e8b4f626f677facb0feef1b581
njrat
53446fe57f6c5a19150e5cfa43c2e48fe5ec92bfc8da1006269dd008e00d07b5
njrat
6fd73de1471bdbd28f8d23d97a6f6f30c9e4ec2ce1c753c43555bd4175576df0
njrat
7e670075c495412da5bef2f982bbbcae2ecc4e5ac175e8c19cdec8af04d2a05a
njrat
841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
njrat
error
njrat
f648a5b82618f7d7d5a29a99ee26ea5872ab1e7321935ae08ca6676d6b7f6427
njrat
+ 177 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat credential_access defense_evasion discovery execution persistence spyware stealer upx
Link:
https://tria.ge/reports/250812-tla6hasxez/
Behaviour
Kills process with taskkill
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
UPX packed file
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Reads data files stored by FTP clients
Unsecured Credentials: Credentials In Files
Uses the VBS compiler for execution
Verdict:
Malicious
Tags:
Win.Packed.Razy-9960873-0
YARA:
n/a
Link:
https://app.threat.zone/submission/e3a0abe1-31fd-4dbf-852f-665f238862d0
Unpacked files
SH256 hash:
841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5
MD5 hash:
12c8d52ed18e13a2fe290565376bffd4
SHA1 hash:
fd200068f17ec2e98ce189c620ed3d4ed0de053f
Link:
https://www.unpac.me/results/96d79b45-b50e-4cd4-9e69-529145b74cbe/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla
Create hunting rule
Author:Harish Kumar P
Description:Yara Rule to Detect AgentTesla
Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:DotNet_Reactor
Create hunting rule
Author:@bartblaze
Description:Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:PureCrypter
Create hunting rule
Author:@bartblaze
Description:Identifies PureCrypter, .NET loader and obfuscator.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe 841ba78131faa5085174f237c07eb33a68e32c7716133f92365fe2a89b47cbb5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3601371/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/20689/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments