MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b0a76ec7bb5def3d0aa5044d3676434b6a10a073abb05de10247c6706ee3bd46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 17
| SHA256 hash: | b0a76ec7bb5def3d0aa5044d3676434b6a10a073abb05de10247c6706ee3bd46 |
|---|---|
| SHA3-384 hash: | 1fe63fb5c7a040ddff1e9d8964fea863813a5d65b5162beb80dbea8094659f21ea2f0a54a3f1809012ca4614c9cadbf6 |
| SHA1 hash: | a92ca96c97b02dbb0b74ff54747eb2828eff5640 |
| MD5 hash: | c1cce296b20dea08d1ba3cea15e9f949 |
| humanhash: | mike-pennsylvania-autumn-maryland |
| File name: | b0a76ec7bb5def3d0aa5044d3676434b6a10a073abb05de10247c6706ee3bd46 |
| Download: | download sample |
| Signature | njrat |
| File size: | 184'616 bytes |
| First seen: | 2026-11-12 14:00:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger) |
| ssdeep | 3072:dufy8ZQoHb9KtyNR/+5JeA8Lcz9Wkra/9sHvUzy8Q2:cymQ8MSXz4zML9eq5 |
| TLSH | T19304285C37E58608E5FF8B74A8B112290AB6F8A79D2AD30D0C9610ED0D76FD48A51F73 |
| TrID | 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  Threatray |
| Tags: | exe Ky9Agent NjRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
203
Origin country :
DEVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 14:25:41 UTC
Tags:
smb auto-startup auto-reg auto-sch scan smbscan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.9%
Tags:
hiddentear infosteal autorun ewind
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating synchronization primitives
Connection attempt
Creating a process from a recently created file
Searching for synchronization primitives
Sending a custom TCP request
Launching a process
Creating a file in the system32 subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a single autorun event
Creating a file in the mass storage device
Enabling autorun
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Adding exclusions to Windows Defender
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm base64 cmd cmdkey crypto csc evasive expand explorer fingerprint hacktool lolbin netsh overlay reconnaissance regedit runonce schtasks stealer wmic
Verdict:
Malicious
Labled as:
Ransom.Hiddentear.A.Generic
Verdict:
Malicious
File Type:
exe x32
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.adwa.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to create processes via WMI
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates multiple autostart registry keys
Creates processes via WMI
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
May drop file containing decryption instructions (likely related to ransomware)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
16 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.22 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Ransomware.HiddenTear
Status:
Malicious
First seen:
2026-11-09 23:19:01 UTC
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
Ky9Agent
Result
Malware family:
n/a
Score:
10/10
Tags:
defense_evasion discovery execution persistence privilege_escalation trojan
Behaviour
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
Windows security bypass
Windows security modification
Adds policy Run key to start application
Creates a large amount of network flows
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader rat sandbox_escape evasion
YARA:
INDICATOR_SUSPICIOUS_DisableWinDefender DelayBatch INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender ProcessInjectionTargets Disable_Defender Antivirus_strings win_hook PasswordStealer INDICATOR_SUSPICIOUS_Binary_References_Browsers DiscordStealer BrowserStealer
Malware Family:
hiddentear
Malicious:
True
Tags:
file-overlay dotnet payload exe persistence
Unpacked files
SH256 hash:
b0a76ec7bb5def3d0aa5044d3676434b6a10a073abb05de10247c6706ee3bd46
MD5 hash:
c1cce296b20dea08d1ba3cea15e9f949
SHA1 hash:
a92ca96c97b02dbb0b74ff54747eb2828eff5640
Detections:
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_DisableWinDefender
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | detect_powershell |
|---|---|
| Author: | daniyyell |
| Description: | Detects suspicious PowerShell activity related to malware execution |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs |
|---|---|
| Author: | ditekSHen |
| Description: | Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing artifacts associated with disabling Widnows Defender |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defender features |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing SQL queries to confidential data stores. Observed in infostealers |
| Rule name: | Macos_Infostealer_Wallets_8e469ea0 |
|---|---|
| Author: | Elastic Security |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (https://www.lukeacha.com) |
| Description: | Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | SUSP_Script_PowerShell_Hidden_Launcher |
|---|---|
| Author: | Marjoriefort |
| Description: | Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar |
| Reference: | Veille fraicheur 2026-09-14 / cluster misses web |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| Rule name: | WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects XWorm (pe, etat extrait) |
| Rule name: | WIN_Sample_Unique_69354b41 |
|---|---|
| Author: | Marjoriefort |
| Description: | Specimen unique (soumission Bazaar) - strings distinctifs propres au sample |
| Reference: | 69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.