🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 14


Intelligence 14 IOCs YARA 40 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26
SHA3-384 hash: cf513808db67254f50393398805eebf1857f6f53b92189b3e4e81dac1200983a48bedbee7e23e635aae18cdf247744bc
SHA1 hash: 640c92982d1d3de852daba1e51036d1950f11ee4
MD5 hash: 7d19b113f3faf859bec3e2c89fc80e03
humanhash: fruit-foxtrot-yellow-eight
File name:haunt.msi
Download: download sample
Signature njrat
Create hunting rule
File size:3'309'962 bytes
First seen:2026-03-13 21:21:23 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:+zy3FLJvoQMmS5icfUvQfCvMWist7EC9B0GiI7yoyaKgIhsi4t1C5gJYDW8s:+zy3tJ
TLSH T107E5E667AEA68440E94B407178FD7E44387936F3C0C9D15C826BD29057E2AF6F64ECAC
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:msi NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/212daaa4-205f-4df3-bcf7-1eb3e654aa8d/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57331/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b4800988c80c015869cb18
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm evasive installer overlay packed wix
Link:
https://www.filescan.io/uploads/69b48005367b6bc6ee7db11e/reports/4700d3b1-ce7a-4961-9663-bcdbfab4e8eb/overview
Verdict:
Suspicious
Labled as:
Generik.LVJOJFR trojan
Link:
https://www.hybrid-analysis.com/sample/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26
Verdict:
Malicious
File Type:
msi
Detections:
Trojan-PSW.MSIL.Agent.sb Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Vimditator.sb Trojan.Win32.Shellcode.sb Trojan.Win32.Scar.uphk Trojan.MSIL.Agent.sb Backdoor.MSIL.PulsarRAT.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26/results?tab=lookup
Result
Threat name:
Quasar, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1883588
Signature
.NET source code contains potential unpacker
Benign windows process drops PE files
Bypasses PowerShell execution policy
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects code into the Windows Explorer (explorer.exe)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Notepad Making Network Connection
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Process Parents
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Quasar RAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1883588 Sample: haunt.msi Startdate: 13/03/2026 Architecture: WINDOWS Score: 100 117 host.fedmenigga.workers.dev 2->117 119 pool.hashvault.pro 2->119 121 ipwho.is 2->121 151 Suricata IDS alerts for network traffic 2->151 153 Malicious sample detected (through community Yara rule) 2->153 155 Multi AV Scanner detection for submitted file 2->155 157 15 other signatures 2->157 13 msiexec.exe 8 33 2->13         started        16 rundll32.exe 2->16         started        19 cmd.exe 2->19         started        21 3 other processes 2->21 signatures3 process4 file5 107 C:\Windows\Installer\MSI7EAB.tmp, PE32+ 13->107 dropped 23 msiexec.exe 3 2 13->23         started        131 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->131 133 Maps a DLL or memory area into another process 16->133 135 Hides threads from debuggers 16->135 27 notepad.exe 3 16->27         started        29 cmd.exe 19->29         started        31 conhost.exe 19->31         started        33 cmd.exe 21->33         started        35 notepad.exe 2 21->35         started        37 conhost.exe 21->37         started        signatures6 process7 file8 95 C:\Users\user\AppData\...\qyjbnsml.dll, PE32+ 23->95 dropped 171 Creates multiple autostart registry keys 23->171 173 Maps a DLL or memory area into another process 23->173 175 Hides threads from debuggers 23->175 177 Queues an APC in another process (thread injection) 23->177 39 notepad.exe 23 32 23->39         started        179 Suspicious powershell command line found 29->179 181 Uses cmd line tools excessively to alter registry or file data 29->181 183 Encrypted powershell cmdline option found 29->183 44 conhost.exe 29->44         started        46 reg.exe 29->46         started        48 powershell.exe 29->48         started        56 2 other processes 29->56 50 conhost.exe 33->50         started        52 reg.exe 33->52         started        54 powershell.exe 33->54         started        58 2 other processes 33->58 signatures9 process10 dnsIp11 123 31.57.147.207, 4782, 49717 RASANAIR Iran (ISLAMIC Republic Of) 39->123 125 host.fedmenigga.workers.dev 172.67.140.32, 443, 49716 CLOUDFLARENETUS United States 39->125 127 ipwho.is 104.20.44.133, 443, 49718 CLOUDFLARENETUS United States 39->127 97 C:\Users\user\AppData\...\yvorq6hYN9cc.bat, DOS 39->97 dropped 99 C:\Users\user\AppData\Roaming\...\SharpDX.dll, PE32 39->99 dropped 101 C:\Users\user\...\SharpDX.Mathematics.dll, PE32 39->101 dropped 103 12 other files (none is malicious) 39->103 dropped 189 System process connects to network (likely due to code injection or exploit) 39->189 191 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 39->191 193 Query firmware table information (likely to detect VMs) 39->193 195 4 other signatures 39->195 60 cmd.exe 1 39->60         started        file12 signatures13 process14 signatures15 197 Suspicious powershell command line found 60->197 199 Uses cmd line tools excessively to alter registry or file data 60->199 201 Encrypted powershell cmdline option found 60->201 203 Bypasses PowerShell execution policy 60->203 63 cmd.exe 9 60->63         started        67 conhost.exe 60->67         started        process16 file17 109 C:\Users\user\AppData\Roaming\...\exhibit.cmd, DOS 63->109 dropped 137 Suspicious powershell command line found 63->137 139 Uses cmd line tools excessively to alter registry or file data 63->139 141 Encrypted powershell cmdline option found 63->141 69 powershell.exe 63->69         started        72 powershell.exe 12 63->72         started        75 reg.exe 1 1 63->75         started        77 2 other processes 63->77 signatures18 process19 file20 159 Injects code into the Windows Explorer (explorer.exe) 69->159 161 Writes to foreign memory regions 69->161 163 Creates a thread in another existing process (thread injection) 69->163 165 Loading BitLocker PowerShell Module 69->165 79 explorer.exe 69->79 injected 83 csc.exe 69->83         started        85 csc.exe 69->85         started        105 C:\Users\user\AppData\Local\...\Represent.tmp, Unicode 72->105 dropped 167 Found suspicious powershell code related to unpacking or dynamic code loading 72->167 169 Creates multiple autostart registry keys 75->169 signatures21 process22 file23 111 C:\Users\user\AppData\...\uzxshgfukvya.sys, PE32+ 79->111 dropped 143 Benign windows process drops PE files 79->143 145 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 79->145 147 Injects code into the Windows Explorer (explorer.exe) 79->147 149 3 other signatures 79->149 87 explorer.exe 79->87         started        113 C:\Users\user\AppData\Local\...\nzk3kcpg.dll, PE32 83->113 dropped 91 cvtres.exe 83->91         started        115 C:\Users\user\AppData\Local\...\npy5ay0k.dll, PE32 85->115 dropped 93 cvtres.exe 85->93         started        signatures24 process25 dnsIp26 129 pool.hashvault.pro 185.84.98.85 COLTENGINECOLTENGINENetworkIT Italy 87->129 185 System process connects to network (likely due to code injection or exploit) 87->185 187 Query firmware table information (likely to detect VMs) 87->187 signatures27
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable Office Document PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/7d19b113f3faf859bec3e2c89fc80e03
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26
Threat name:
Win32.Hacktool.Wovdnut
Create hunting rule
Status:
Malicious
First seen:
2026-03-13 02:31:03 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
9 of 24 (37.50%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4s6spxurhiywwibt5nc3v4q3ucp7auaaveifil377ribc62k5yta._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
error
njrat
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar persistence privilege_escalation spyware trojan
Link:
https://tria.ge/reports/260313-z7znwab16r/
Behaviour
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Quasar RAT
Quasar family
Quasar payload
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e4bd27de913a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e4bd27de913a316b2033eb45baf21ba09ff05000a910542f7ffc50117b4aee26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:Check_VBox_Guest_Additions
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:MAL_BackNet_Nov18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:MAL_BackNet_Nov18_1_RID2D6D
Create hunting rule
Author:Florian Roth
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Pulsar_RAT
Create hunting rule
Author:@bartblaze
Description:Identifies Pulsar RAT, based on Quasar RAT.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.pulsar_rat
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_Donutloader_f40e3759
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57331/

Comments