🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
SHA3-384 hash: fb31cf95e980644ad00da6be5aeabaf0f9c7caf0b402a791c1fa82ff65b06168f1739d63f550b10271ed7cd9c61972e8
SHA1 hash: e958fb5e4d506d53f4fefbf947e915d373295705
MD5 hash: 04cf074e17d3419bdcdedc9547aff380
humanhash: carolina-cola-papa-equal
File name:e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
Download: download sample
Signature njrat
Create hunting rule
File size:491'168 bytes
First seen:2025-12-08 15:53:04 UTC
Last seen:2026-01-09 15:11:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0293eec0b5432ad092f24065016203b2 (22 x GuLoader, 18 x RemcosRAT, 6 x Formbook)
ssdeep 12288:3taCsbek8D7TGGCx6m8pUVeI/Dk4wNLFyVt3OAQN6+:3ECsO6GCx65pO/7wNLF4kNt
TLSH T18FA4234B9672C857E5AF0AB21E7557026FE0AD0672D3672B37182B883936F83641F05F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 30bc8ce4b48046c2 (6 x njrat)
Reporter adrian__luca
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/72184ade-c623-48b4-9f38-02574b0203e5/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
Verdict:
Malicious activity
Analysis date:
2025-12-09 04:33:34 UTC
Tags:
auto-reg remcos rat
Link:
https://app.any.run/tasks/836266c7-7867-41d1-a3f1-d73a88303109

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/43724/
Detection(s):
SecuriteInfo.com.W32.Injector.NARR-7392.5293.28380.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936f4d2db58e1a2c22b9a56
Tags:
remcos nsis
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file
Delayed reading of the file
DNS request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-26T00:29:00Z UTC
Last seen:
2025-12-10T10:59:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/74299fb7-20ea-45f5-862b-b24fb01697c9
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/04cf074e17d3419bdcdedc9547aff380
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2025-11-26 03:58:09 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4gxqbl5osiz46u264zp275qfyc65kwfsigff5pchz6t43lr5e4la._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery installer persistence rat
Link:
https://tria.ge/reports/251208-tbv3xsxre1/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Remcos
Remcos family
Malware Config
C2 Extraction:
176.117.107.48:2404
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/38b0f7f2-d386-4a12-9022-f5ea3ca57268
Unpacked files
SH256 hash:
e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716
MD5 hash:
04cf074e17d3419bdcdedc9547aff380
SHA1 hash:
e958fb5e4d506d53f4fefbf947e915d373295705
Link:
https://www.unpac.me/results/e937c3ad-52fc-4d26-9a3f-a26e297f138c/
SH256 hash:
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 hash:
12b140583e3273ee1f65016becea58c4
SHA1 hash:
92df24d11797fefd2e1f8d29be9dfd67c56c1ada
Link:
https://www.unpac.me/results/e937c3ad-52fc-4d26-9a3f-a26e297f138c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/e1af00afae9233cf535ee65faff605c0bdd558b2418a5ebc47cfa7cdae3d2716

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43724/

Comments