🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3
SHA3-384 hash: 565886f1eb2f5129cd8b7101172c758f6255666db804081e55bbb206ff0a0397867c824f34e2feb3e506c5d7c39d505b
SHA1 hash: 2dfc2d0dbe7f2fee8707baae6796c040212bcc32
MD5 hash: f04c8fb293473eb2746ffd5c0105942c
humanhash: oscar-mexico-louisiana-nineteen
File name:FACTURA.exe
Download: download sample
Signature njrat
Create hunting rule
File size:337'752 bytes
First seen:2025-10-24 10:37:58 UTC
Last seen:2025-11-06 11:20:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep 6144:fUj/wxHOQaIYHl671Vogzs7BdT5TLK0TjxT9NyaX3RJ+UrgKAsArdTHM:fqsHFel4ogGBHR9fQb5Ts
TLSH T1F874125276C1E4B7F5A24A742CF3C7B6C67D79D4205A02430BA1AF793D31387EA1219E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c4dadadad2f492c2 (149 x GuLoader, 53 x RemcosRAT, 23 x VIPKeylogger)
Reporter lowmal3
Tags:exe NjRAT signed

Code Signing Certificate

Organisation:Silvertip
Issuer:Silvertip
Algorithm:sha256WithRSAEncryption
Valid from:2025-09-12T03:54:19Z
Valid to:2026-09-12T03:54:19Z
Serial number: 50f7f2bbf29aac8fc0b99623e5f8b986d1b54993
Thumbprint Algorithm:SHA256
Thumbprint: 3e1ea4ce2ca51a50271b02a84b190475cbef9eab77c3bfe960e064da721312f6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
FACTURA.exe
Verdict:
Malicious activity
Analysis date:
2025-10-24 10:38:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/838eb8f5-c06a-41d4-8ca4-065eaa94a118

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34026/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68fb57346c859164aa63e54d
Tags:
injection injector virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt
Creating a file in the %temp% subdirectories
Delayed reading of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer masquerade microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/68fb5731acdc0d13837ed67b/reports/1207b154-eb2d-4d1d-b179-67f56354584f/overview
Verdict:
Malicious
Labled as:
Malware_53.9
Link:
https://www.hybrid-analysis.com/sample/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-24T06:24:00Z UTC
Last seen:
2025-10-26T07:56:00Z UTC
Hits:
~1000
Detections:
VHO:Trojan.NSIS.GuLoader.gen Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sbb Trojan.NSIS.Makoob.sba Packed.NSIS.Krynis.sb HEUR:Trojan.Win32.GuLoader.gen
Link:
https://opentip.kaspersky.com/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/112e211f-d234-44da-896d-b7f001903fa9
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1801191
Signature
AI detected suspicious PE digital signature
Antivirus / Scanner detection for submitted sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1801191 Sample: FACTURA.exe Startdate: 24/10/2025 Architecture: WINDOWS Score: 100 30 www.pftraveldev.xyz 2->30 32 eshatelecom.com 2->32 34 3 other IPs or domains 2->34 44 Suricata IDS alerts for network traffic 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 52 3 other signatures 2->52 10 FACTURA.exe 3 39 2->10         started        signatures3 50 Performs DNS queries to domains with low reputation 30->50 process4 file5 28 C:\Users\user\AppData\Local\...\System.dll, PE32 10->28 dropped 62 Tries to detect virtualization through RDTSC time measurements 10->62 64 Switches to a custom stack to bypass stack traces 10->64 14 FACTURA.exe 6 10->14         started        signatures6 process7 dnsIp8 40 drive.usercontent.google.com 142.250.73.97, 443, 49703 GOOGLEUS United States 14->40 42 drive.google.com 142.251.34.206, 443, 49702 GOOGLEUS United States 14->42 66 Maps a DLL or memory area into another process 14->66 18 ynI0dQMp.exe 14->18 injected signatures9 process10 process11 20 dfrgui.exe 13 18->20         started        signatures12 54 Tries to steal Mail credentials (via file / registry access) 20->54 56 Tries to harvest and steal browser information (history, passwords, etc) 20->56 58 Modifies the context of a thread in another process (thread injection) 20->58 60 3 other signatures 20->60 23 WAp3RKQxD.exe 20->23 injected 26 firefox.exe 20->26         started        process13 dnsIp14 36 eshatelecom.com 194.163.135.223, 49706, 80 NEXINTO-DE Germany 23->36 38 www.pftraveldev.xyz 76.223.54.146, 49707, 49708, 80 AMAZON-02US United States 23->38
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2025-10-24 10:38:40 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsxouflelmnhbi4e4d5ih4ypzkrrtfwczzypvv2ffgdqqpkmvwrq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:guloader discovery downloader rat spyware stealer trojan
Link:
https://tria.ge/reports/251024-mpqa9syqak/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Formbook payload
Formbook
Formbook family
Guloader family
Guloader,Cloudeye
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/086cbbbc-e58d-4e7e-b609-eb5de0ca9f53
Unpacked files
SH256 hash:
acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3
MD5 hash:
f04c8fb293473eb2746ffd5c0105942c
SHA1 hash:
2dfc2d0dbe7f2fee8707baae6796c040212bcc32
Link:
https://www.unpac.me/results/7bc5514e-1d40-4724-9cf2-f793b98aa9f9/
SH256 hash:
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 hash:
a4dd044bcd94e9b3370ccf095b31f896
SHA1 hash:
17c78201323ab2095bc53184aa8267c9187d5173
Link:
https://www.unpac.me/results/7bc5514e-1d40-4724-9cf2-f793b98aa9f9/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/acaeea15645b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

Executable exe acaeea15645b1a70a384e0fa83f30fcaa31996c2ce70fad7452987083d4cada3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/34026/

Comments