MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 18

Intelligence 18 IOCs YARA 10 File information Comments

SHA256 hash:	9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b
SHA3-384 hash:	c21ce225355ee2d204ec65c8897b5b314cf6b11f82f7817446945fd9f42d37b0990575586f25793d5ccc50c63a02c6a9
SHA1 hash:	f1d3868c1e7e9b29c9ab64047f32ebecef5a1712
MD5 hash:	72c5e3aaf49fd65d76a1c6b3737d04d1
humanhash:	freddie-sierra-island-echo
File name:	XPTR7890987667800.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	496'128 bytes
First seen:	2025-08-01 16:53:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 35 x Loda, 33 x Loki)
ssdeep	12288:LOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi4qaAx6Vx1k:Lq5TfcdHj4fmbK6VE
Threatray	2'677 similar samples on MalwareBazaar
TLSH	T1EAB412905998CC62F9E07330C07BCF900A697A32DD856B1E2BDDF65AB8727435486B3D
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'698 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla)
Reporter	threatcat_ch
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b.exe

Verdict:

Malicious activity

Analysis date:

2025-08-01 16:55:58 UTC

Tags:

auto-startup

Link:

https://app.any.run/tasks/fa2ba412-c5cd-4b8f-8e2c-aa01c871ca2b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/18337/

Detection(s):

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=688cf139af3050dc8d333326

Tags:

autorun spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Sending a TCP request to an infection source

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug autoit cmdkey compiled-script cscript findstr hacktool lolbin microsoft_visual_cc overlay packed packed packed pcalua rasautou upx

Link:

https://www.filescan.io/uploads/688cf14f32e61090868a6906/reports/aad931ca-2b41-4173-8c0d-bdaa3dd0d15d/overview

Verdict:

Malicious

Labled as:

Trojan.AutoIt_Heur

Link:

https://www.hybrid-analysis.com/sample/9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6fdaf0b3-d87f-4d08-b5d5-9c28e9e82df3

Result

Threat name:

XWorm

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1748615

Signature

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Drops VBS files to the startup folder

Found malware configuration

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/72c5e3aaf49fd65d76a1c6b3737d04d1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b/

Verdict:

Malicious

Threat:

Trojan.Win32.Strab

Link:

https://tip.neiki.dev/file/9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-08-01 16:41:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t3wt2cw7vr5aewvs3wfpa5map4vahxl3x27xbgn3lg2m4god6cfq._file

Verdict:

malicious

Label(s):

unc_loader_036

autoit

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm discovery rat trojan upx

Link:

https://tria.ge/reports/250801-venzfssrz4/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Drops startup file

Executes dropped EXE

Detect Xworm Payload

Xworm

Xworm family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e7574b55-d460-4be9-b376-4820ab818814

Unpacked files

SH256 hash:

9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

MD5 hash:

72c5e3aaf49fd65d76a1c6b3737d04d1

SHA1 hash:

f1d3868c1e7e9b29c9ab64047f32ebecef5a1712

Link:

https://www.unpac.me/results/0b472648-80d5-467d-b015-3f89cdf419f2/

SH256 hash:

d396d7ca5d5215e4f63eea26010ea662194ec29fdb21b38c6c9487255b352035

MD5 hash:

54400e5dc39656bdbd08c030b4f73960

SHA1 hash:

041144995deba4c8de6b5986d2797f438eb21188

Link:

https://www.unpac.me/results/0b472648-80d5-467d-b015-3f89cdf419f2/

SH256 hash:

dec05abdc397e043174786a616526e8a32affffb458b91bea5fcab062de21f62

MD5 hash:

3cf3e1b5fd6101209e2a0e085ec73414

SHA1 hash:

a7adf0a1636bbc90c940409c2c56bd2826a463c4

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/0b472648-80d5-467d-b015-3f89cdf419f2/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9eed3d0adfac/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

exe 9eed3d0adfac7a025ab2dd8af075807f2a03dd7bbebf7099bb59b4ce19c3f08b

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/18337/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetUseConnectionW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample