🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 16


Intelligence 16 IOCs YARA 28 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f
SHA3-384 hash: e643b757b278c779bf135cec32350e816c9dace78133454a60e85d27bb7405280aefe59f2903bae311eb9bb6eedd6446
SHA1 hash: 7e4910429f10a3283d18244accddd302275a2b30
MD5 hash: 9739837bc8cbff2ee7d8d97e78408238
humanhash: jersey-ack-mountain-kansas
File name:SecuriteInfo.com.BackDoor.AsyncRATNET.2.20230.248
Download: download sample
Signature njrat
Create hunting rule
File size:17'278'976 bytes
First seen:2025-06-10 09:53:28 UTC
Last seen:2025-06-10 10:26:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a9c887a4f18a3fede2cc29ceea138ed3 (37 x CoinMiner, 19 x AsyncRAT, 18 x QuasarRAT)
ssdeep 393216:hP8EOHrBL9xB7fAgSWdNwBllVcFL47bxeEz:hEESNvB7ffwPlVgwb
TLSH T1BC07337DF8354D51C4A26E70113167106C692F30BFE676A21627E33CC81EAA51E6B2FE
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.4% (.EXE) Win32 Executable (generic) (4504/4/1)
5.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
238
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
njrat
Create hunting rule
ID:
1
File name:
https://github.com/s7bhme/gg/raw/refs/heads/main/x69gg.exe
Verdict:
Malicious activity
Analysis date:
2025-06-05 20:44:11 UTC
Tags:
github python discord bdaejec backdoor njrat aspack amsi-bypass
Link:
https://app.any.run/tasks/19d6bb57-8e43-46e4-8546-d0cca97c0057

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8618/
Detection(s):
SecuriteInfo.com.BackDoor.AsyncRATNET.2.20230.248.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684800d28bd5d68a12e765fd
Tags:
vmdetect autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Creating a file
Creating a window
Running batch commands
Delayed reading of the file
DNS request
Connection attempt
Sending a custom TCP request
Changing an executable file
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Infecting executable files
Using obfuscated Powershell scripts
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/04a860dd-cf11-430e-9167-8d487a3ef9e9
Result
Threat name:
Babadeda, Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1710687
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Disables UAC (registry)
Disables Windows Defender (via service or powershell)
Disables zone checking for all users
Drops PE files to the startup folder
Encrypted powershell cmdline option found
Found malware configuration
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the prolog of user mode functions (user mode inline hooks)
Modifies Windows Defender protection settings
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Babadeda
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1710687 Sample: SecuriteInfo.com.BackDoor.A... Startdate: 10/06/2025 Architecture: WINDOWS Score: 100 116 grayhatfuckscammer.ddns.net 2->116 118 discordapp.com 2->118 120 Suricata IDS alerts for network traffic 2->120 122 Found malware configuration 2->122 124 Malicious sample detected (through community Yara rule) 2->124 128 19 other signatures 2->128 11 SecuriteInfo.com.BackDoor.AsyncRATNET.2.20230.248.exe 2 2->11         started        15 x69.exe 2->15         started        17 x69s.exe 2->17         started        19 7 other processes 2->19 signatures3 126 Uses dynamic DNS services 116->126 process4 file5 92 C:\Users\user\AppData\Local\...\x69m5tl.exe, PE32 11->92 dropped 142 Encrypted powershell cmdline option found 11->142 21 x69m5tl.exe 6 11->21         started        25 powershell.exe 23 11->25         started        94 C:\Users\...\backend_c.cp313-win_amd64.pyd, PE32+ 15->94 dropped 96 C:\Users\user\...\_cffi.cp313-win_amd64.pyd, PE32+ 15->96 dropped 98 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 15->98 dropped 102 32 other files (none is malicious) 15->102 dropped 27 x69.exe 15->27         started        100 C:\Users\user\AppData\Local\...\x69s.exe.log, ASCII 17->100 dropped signatures6 process7 file8 84 C:\Users\user\AppData\Local\Temp\x69s.exe, PE32 21->84 dropped 86 C:\Users\user\AppData\...\x69Install.exe, PE32 21->86 dropped 88 C:\Users\user\...\x69Disable-winDefender.exe, PE32 21->88 dropped 90 C:\Users\user\AppData\Local\Temp\x69.exe, PE32+ 21->90 dropped 130 Bypasses PowerShell execution policy 21->130 132 Uses schtasks.exe or at.exe to add and modify task schedules 21->132 134 Adds a directory exclusion to Windows Defender 21->134 29 x69s.exe 21->29         started        33 x69.exe 70 21->33         started        35 powershell.exe 23 21->35         started        39 4 other processes 21->39 136 Loading BitLocker PowerShell Module 25->136 37 conhost.exe 25->37         started        signatures9 process10 file11 104 C:\...\fabd6cd1e63028793ca8d3545eb05427.exe, PE32 29->104 dropped 148 Protects its processes via BreakOnTermination flag 29->148 150 Disables zone checking for all users 29->150 152 Creates autostart registry keys with suspicious names 29->152 156 3 other signatures 29->156 41 cmd.exe 29->41         started        44 cmd.exe 29->44         started        46 cmd.exe 29->46         started        57 5 other processes 29->57 106 C:\Users\...\backend_c.cp313-win_amd64.pyd, PE32+ 33->106 dropped 108 C:\Users\user\...\_cffi.cp313-win_amd64.pyd, PE32+ 33->108 dropped 110 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 33->110 dropped 112 32 other files (none is malicious) 33->112 dropped 48 x69.exe 33->48         started        154 Loading BitLocker PowerShell Module 35->154 51 conhost.exe 35->51         started        53 conhost.exe 39->53         started        55 conhost.exe 39->55         started        59 2 other processes 39->59 signatures12 process13 dnsIp14 138 Modifies Windows Defender protection settings 41->138 140 Disables Windows Defender (via service or powershell) 41->140 61 powershell.exe 41->61         started        64 conhost.exe 41->64         started        66 reg.exe 44->66         started        68 conhost.exe 44->68         started        76 2 other processes 46->76 114 discordapp.com 162.159.133.233, 443, 49723 CLOUDFLARENETUS United States 48->114 70 cmd.exe 48->70         started        72 cmd.exe 48->72         started        74 conhost.exe 57->74         started        78 6 other processes 57->78 signatures15 process16 signatures17 144 Loading BitLocker PowerShell Module 61->144 146 Disables UAC (registry) 66->146 80 conhost.exe 70->80         started        82 conhost.exe 72->82         started        process18
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f
Threat name:
Win32.Dropper.Dapato
Create hunting rule
Status:
Malicious
First seen:
2025-05-17 23:15:59 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
30 of 36 (83.33%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lxvevpkyssnc2ka4qsms5esy25nr7np2jbammwdog45ddptwr7q._file
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:bdaejec family:njrat botnet:m5tl aspackv2 backdoor defense_evasion discovery evasion execution persistence privilege_escalation pyinstaller trojan
Link:
https://tria.ge/reports/250610-lxaecaszfy/
Behaviour
Views/modifies file attributes
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Modifies registry key
Modifies data under HKEY_USERS
Enumerates system info in registry
Checks SCSI registry key(s)
System Location Discovery: System Language Discovery
Event Triggered Execution: Netsh Helper DLL
Enumerates physical storage devices
Detects Pyinstaller
Launches sc.exe
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops file in System32 directory
Adds Run key to start application
Modifies Security services
Obfuscated Files or Information: Command Obfuscation
Loads dropped DLL
Indicator Removal: Clear Windows Event Logs
Executes dropped EXE
Drops startup file
Checks computer location settings
Checks BIOS information in registry
ASPack v2.12-2.42
Stops running service(s)
Modifies Windows Firewall
Command and Scripting Interpreter: PowerShell
njRAT/Bladabindi
UAC bypass
Suspicious use of NtCreateUserProcessOtherParentProcess
Njrat family
Modifies security service
Modifies Windows Defender Real-time Protection settings
Modifies Windows Defender DisableAntiSpyware settings
Detects Bdaejec Backdoor.
Bdaejec family
Bdaejec
Malware Config
C2 Extraction:
grayhatfuckscammer.ddns.net:1177
ddos.dnsnb8.net
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c42eec7c-b29d-4b2f-bb37-0d36b8276aaa
Unpacked files
SH256 hash:
daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f
MD5 hash:
9739837bc8cbff2ee7d8d97e78408238
SHA1 hash:
7e4910429f10a3283d18244accddd302275a2b30
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
SH256 hash:
eddde01ac771905ffd23df9b49669eb1c221f2a5c548e1b9696d08079ee35e00
MD5 hash:
c0674b8d64ead3fefd2150a3cc834223
SHA1 hash:
0805d15a1453168183c3ac01b0b05c9cc9201d35
Detections:
win_njrat_w1
Create hunting rule
NjRat
Create hunting rule
MAL_Winnti_Sample_May18_1
Create hunting rule
CN_disclosed_20180208_c
Create hunting rule
Unknown_Malware_Sample_Jul17_2
Create hunting rule
Njrat
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
MALWARE_Win_NjRAT
Create hunting rule
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
SH256 hash:
e1c4d6d263c944d301d7f8d1abb22203426b1b70d28994a47ad1a121fc107e1e
MD5 hash:
ca0d4a9cbf473c15d0ebc27fb1c435c5
SHA1 hash:
73e2baa681cb194553fd753c3a94dcc4a9c8da92
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
SH256 hash:
f4e40bc74f180ad361fe055f8ea607e1e3b4d2f250a09d3e8b162220d6b183c7
MD5 hash:
aa8f2e17e7febf074d11787c95dfdb73
SHA1 hash:
48460e279033a4d1e4fb38f094e296a8e219d685
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
SH256 hash:
f12428dc9c9f900d671d4135cfda52b7de9bfb6b34c5c336dbf88941db8575e1
MD5 hash:
22d6b7ab5c8a05162d36d2981b715c28
SHA1 hash:
7adc2e2c90b8dfcee0c34a86ad4d0cac79daf9f3
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
SH256 hash:
9157fc7ae2764c949ce1c04a2a1ebca3a016bb417bdecf9579d2ab56900ca372
MD5 hash:
61952d5b251c4e3e70fffd1074e54e3e
SHA1 hash:
bdd6e740693ae01b1b16d67b6504a6bc127d2f22
Link:
https://www.unpac.me/results/57520b55-84f9-4032-ad80-9feadb09ab0b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ASPackv212AlexeySolodovnikov
Create hunting rule
Author:malware-lu
Rule name:ASProtectV2XDLLAlexeySolodovnikov
Create hunting rule
Author:malware-lu
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:elysium
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked elysium stealer malware samples.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
Rule name:INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables containing artifacts associated with disabling Widnows Defender
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:MALWARE_Win_R77
Create hunting rule
Author:ditekSHen
Description:Detects r77 rootkit
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Rootkit_R77_d0367e28
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit
Rule name:win_unidentified_045_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.unidentified_045.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe daef5255eac4a4d16940e424c97492c6bad8fdafd2420632c371b9d18df3b47f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3560208/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/8618/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA

Comments