MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aa2d17f2af1fcc37424c29d0c49be04f29c4c94dcbe089ddc36037e4b6b5b3b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 17
| SHA256 hash: | aa2d17f2af1fcc37424c29d0c49be04f29c4c94dcbe089ddc36037e4b6b5b3b8 |
|---|---|
| SHA3-384 hash: | 6d4cf70a9ca34792bbb95386d105456d55cfe5813f27d642319e5695b58f43c7670068fb8177bf60c8332c46a2d97d5e |
| SHA1 hash: | 3acc806959f1524aa84317f200ef86eb5ed8523a |
| MD5 hash: | 1c1f15a713a56ec6590bd32a4f5f0437 |
| humanhash: | cold-april-black-leopard |
| File name: | aa2d17f2af1fcc37424c29d0c49be04f29c4c94dcbe089ddc36037e4b6b5b3b8 |
| Download: | download sample |
| Signature | njrat |
| File size: | 570'880 bytes |
| First seen: | 2025-07-31 11:34:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger) |
| ssdeep | 12288:LK390Rk1Fh9pkRW10cLyWuqTi2jMh4nlxESZeAsLA6kKX:e34w/f0cLy9cjTlxEShsk6kK |
| Threatray | 4'203 similar samples on MalwareBazaar |
| TLSH | T143C4E12471B9CC06CA5D833C59B3F17803B9DE89A612C31E9FD47EAFB9697911E011A3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer) |
| Reporter |  JAMESWT_WT |
| Tags: | 196-251-88-252 exe NjRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
144
Origin country :
ITVendor Threat Intelligence
Malware family:
njrat
ID:
1
File name:
aa2d17f2af1fcc37424c29d0c49be04f29c4c94dcbe089ddc36037e4b6b5b3b8
Verdict:
Malicious activity
Analysis date:
2025-07-31 11:58:31 UTC
Tags:
njrat rat bladabindi
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
90.2%
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Connection attempt
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
njRAT
Verdict:
Malicious
Score:
99%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.24 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Status:
Malicious
First seen:
2025-07-29 03:53:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 38 (55.26%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
unc_loader_037
njrat
Similar samples:
+ 4'193 additional samples on MalwareBazaar
Result
Malware family:
njrat
Score:
10/10
Tags:
family:njrat botnet:nyan cat discovery trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
196.251.88.252:5085
Verdict:
Suspicious
Tags:
Bladabindi njrat
YARA:
n/a
Unpacked files
SH256 hash:
aa2d17f2af1fcc37424c29d0c49be04f29c4c94dcbe089ddc36037e4b6b5b3b8
MD5 hash:
1c1f15a713a56ec6590bd32a4f5f0437
SHA1 hash:
3acc806959f1524aa84317f200ef86eb5ed8523a
SH256 hash:
01b0eee9d9081aee73751aa973dbb46fe8b1af574f85e71b4e9a942ec904f97a
MD5 hash:
c02e6e6786f71b4773604808d551a323
SHA1 hash:
264924d7021b5ba383c57e59e5af858aa47c3a80
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
a08d2e497129a014114950ced6ad103f2f9b0e5e7e302a4279977a5402dbea53
MD5 hash:
b2eac837462e98ffa929b70a2db5150b
SHA1 hash:
e0ef8f1722cd89437964f81be6ea3f462a429af4
Detections:
win_njrat
win_njrat_bytecodes_V2_oct_2023
SH256 hash:
8d26523d1f9666dfba6e35320172df143d157a4b3f69d56fc383171257ad2c80
MD5 hash:
ab0419ed360d445a6ac977fef081c91c
SHA1 hash:
e4f7a8c0bf7dedcabfacebf5a59dec7817dd45a2
Malware family:
njRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ByteCode_MSIL_Backdoor_NjRAT |
|---|---|
| Author: | ReversingLabs |
| Description: | Yara rule that detects NjRAT backdoor. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | njrat_v1 |
|---|---|
| Author: | RandomMalware |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | win_njrat_bytecodes_V2_oct_2023 |
|---|---|
| Author: | Matthew @ Embee_Research |
| Rule name: | yarahub_win_njrat_bytecodes_V2_oct_2023 |
|---|---|
| Author: | Matthew @ Embee_Research |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.