MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fe5a033c8415522a190dec8e3072f053dfb458cd47bb208b17cb3d96740fdc34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 13
| SHA256 hash: | fe5a033c8415522a190dec8e3072f053dfb458cd47bb208b17cb3d96740fdc34 |
|---|---|
| SHA3-384 hash: | b97b0604853a91f141c7ae50bcb46b273ac905c2ae673d85f75a7e4037283c96d3005ee7ca4cf8112a59f2786c78ea15 |
| SHA1 hash: | f3cb46bb614aecc2b78cec370d75e04e60c3eb6f |
| MD5 hash: | 804346c1b45aedd1e52963906275c135 |
| humanhash: | king-nebraska-oven-two |
| File name: | fe5a033c8415522a190dec8e3072f053dfb458cd47bb208b17cb3d96740fdc34 |
| Download: | download sample |
| Signature | njrat |
| File size: | 2'670'080 bytes |
| First seen: | 2026-07-07 13:38:07 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'499 x Formbook, 12'374 x SnakeKeylogger) |
| ssdeep | 49152:HWgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw44emN3c:HWgVUuHjkDGjYQDGuRxzew |
| Threatray | 55 similar samples on MalwareBazaar |
| TLSH | T171C50268E3E4C60AE57E4BB4E57699610371FE665C55C7CC4CF938AE00B2F44AA207B3 |
| TrID | 49.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 29.3% (.EXE) InstallShield setup (43053/19/16) 4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win64 Executable (generic) (6522/11/2) 3.4% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| dhash icon | aeaeaeaeaeaeaeae (1 x Amadey, 1 x njrat) |
| Reporter |  Threatray |
| Tags: | exe NjRAT RAT ShitRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
173
Origin country :
DEVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
fe5a033c8415522a190dec8e3072f053dfb458cd47bb208b17cb3d96740fdc34.exe
Verdict:
Malicious activity
Analysis date:
2026-07-07 13:42:34 UTC
Tags:
stealer raton rat auto-reg
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
99.9%
Tags:
clipbanker vmdetect emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Creating a file
Launching a process
Creating a process from a recently created file
Loading a suspicious library
Using the Windows Management Instrumentation requests
Creating a window
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Adware.MSILHeracles.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-06T03:06:00Z UTC
Last seen:
2026-07-07T23:48:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Agent.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealer.sb Trojan-PSW.MSIL.Agent.sb HEUR:Trojan.Win32.Generic HEUR:Backdoor.MSIL.Agent.gen Backdoor.MSIL.Crysan.d NetTool.TunnelLocaltonet.UDP.C&C
Verdict:
Malicious
Score:
99%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.RATONRAT
Threat name:
Win32.Infostealer.ClipBanker
Status:
Malicious
First seen:
2026-07-06 06:52:38 UTC
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
shitrat
Similar samples:
+ 45 additional samples on MalwareBazaar
Result
Malware family:
ratonrat
Score:
10/10
Tags:
family:ratonrat adware defense_evasion execution persistence spyware stealer
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Modifies Internet Explorer settings
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates connected drives
Maps connected drives based on registry
Checks BIOS information in registry
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Command and Scripting Interpreter: PowerShell
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Detects RatonRAT payload
Family: RatonRAT
Malware Config
C2 Extraction:
fywolbuv6v.localto.net:1390
Unpacked files
SH256 hash:
fe5a033c8415522a190dec8e3072f053dfb458cd47bb208b17cb3d96740fdc34
MD5 hash:
804346c1b45aedd1e52963906275c135
SHA1 hash:
f3cb46bb614aecc2b78cec370d75e04e60c3eb6f
SH256 hash:
0b0382f872e3a4db83b199911426f84665f55cdc53710cd15ffa52fcdf8a9fbc
MD5 hash:
dfebe6a612af8581d1eca610e0763800
SHA1 hash:
2c162ee451fcecfad2f0db34f406ab4d7bac16e5
SH256 hash:
3e60e50ff6657a392edd57a2a71c06e59df43c8d27f73e4e0604c057aa10d971
MD5 hash:
17382123f96442304c0a87cd4e725560
SHA1 hash:
05c7dabf47a4cc98e8e0e7e831676ba047cd08e3
SH256 hash:
b58a822e5bdfca93ec38bc481bc00a5ad38cfe4103526421ab28d346791a2a09
MD5 hash:
86c5cf90b1d2847b7df60ce79c2145d6
SHA1 hash:
084c6ec381d1125dc02cee5b97cf7f468f48976a
SH256 hash:
6bf97a2837c894f10012c2889c064ed07b698581296839035f663dfd82bcd3b4
MD5 hash:
41741d072f1db7f9bd854f5ae3d1c5dc
SHA1 hash:
0ee05639220264482a0fd8133371c2cb7820f4b6
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
SH256 hash:
7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 hash:
f6940019dad6c782bcb645c2f7d52db5
SHA1 hash:
1bbe492757bf99840d923fdd44c6a3f34b336cf7
SH256 hash:
1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
MD5 hash:
4b874a3043d5e3c133f4c35863159638
SHA1 hash:
3a7d21700497d81c41193544b7ea913032d0aa82
SH256 hash:
376c2f4b301aec11b63209dd84228284d0f6be64b4f92dcb4e401ca683e563c7
MD5 hash:
4e06ebd6254394a86fdfdb70898cbb7b
SHA1 hash:
eadb65e33003f04351dd01611c683b68774682e1
SH256 hash:
5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 hash:
e90ac3063409ef6876e26422dc61d0eb
SHA1 hash:
3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SH256 hash:
2f1725d05b424f154f931a3c96a14318d48da2297c12fb33b384786a9a70f717
MD5 hash:
f6aa556b07dcfb7d3105e1eab11f8162
SHA1 hash:
44a66ea7c6d0e456006515226a03a31862f5b52a
SH256 hash:
d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 hash:
f8d5274e3368aa40cc0fd5798d19c783
SHA1 hash:
87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SH256 hash:
3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 hash:
c1b78af3d6402be8f259dbbe9250e7fb
SHA1 hash:
98e2c38597c50390852801d46ff342889c7351ae
SH256 hash:
fae06a2e756e6332df98f16991a0183bd61fbe83a015d83d4518461c120977a7
MD5 hash:
1494a1cde33c013757b4f397a727d372
SHA1 hash:
c384672f7c7946637f9684e36b406a28f5f8f7ed
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
SH256 hash:
5516f7b78eb7c391e50872a1cb5fa91e58daf02298478deef8b1269576088ec2
MD5 hash:
bb94fc038231aaa7a84281de4c188259
SHA1 hash:
d24570af262fc7614e52cd1b15a758dbb4356eaa
SH256 hash:
7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 hash:
f6940019dad6c782bcb645c2f7d52db5
SHA1 hash:
1bbe492757bf99840d923fdd44c6a3f34b336cf7
SH256 hash:
1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
MD5 hash:
4b874a3043d5e3c133f4c35863159638
SHA1 hash:
3a7d21700497d81c41193544b7ea913032d0aa82
SH256 hash:
82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 hash:
115137414b41a26d6e73738cd94c036c
SHA1 hash:
e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SH256 hash:
5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 hash:
e90ac3063409ef6876e26422dc61d0eb
SHA1 hash:
3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SH256 hash:
d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
MD5 hash:
0bfef61b203054f6fbf08419ffe3f018
SHA1 hash:
ed9d0418507630996eb2c473ec5daf11d185c2c6
SH256 hash:
2f1725d05b424f154f931a3c96a14318d48da2297c12fb33b384786a9a70f717
MD5 hash:
f6aa556b07dcfb7d3105e1eab11f8162
SHA1 hash:
44a66ea7c6d0e456006515226a03a31862f5b52a
SH256 hash:
d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 hash:
f8d5274e3368aa40cc0fd5798d19c783
SHA1 hash:
87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SH256 hash:
3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 hash:
c1b78af3d6402be8f259dbbe9250e7fb
SHA1 hash:
98e2c38597c50390852801d46ff342889c7351ae
SH256 hash:
fae06a2e756e6332df98f16991a0183bd61fbe83a015d83d4518461c120977a7
MD5 hash:
1494a1cde33c013757b4f397a727d372
SHA1 hash:
c384672f7c7946637f9684e36b406a28f5f8f7ed
SH256 hash:
5516f7b78eb7c391e50872a1cb5fa91e58daf02298478deef8b1269576088ec2
MD5 hash:
bb94fc038231aaa7a84281de4c188259
SHA1 hash:
d24570af262fc7614e52cd1b15a758dbb4356eaa
SH256 hash:
82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 hash:
115137414b41a26d6e73738cd94c036c
SHA1 hash:
e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SH256 hash:
d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
MD5 hash:
0bfef61b203054f6fbf08419ffe3f018
SHA1 hash:
ed9d0418507630996eb2c473ec5daf11d185c2c6
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_Qemu_Description |
|---|
| Rule name: | Check_Qemu_DeviceMap |
|---|
| Rule name: | Check_VBox_Description |
|---|
| Rule name: | Check_VBox_DeviceMap |
|---|
| Rule name: | Check_VBox_Guest_Additions |
|---|
| Rule name: | Check_VmTools |
|---|
| Rule name: | Check_VMWare_DeviceMap |
|---|
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | grakate_stealer_nov_2021 |
|---|
| Rule name: | INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs |
|---|---|
| Author: | ditekSHen |
| Description: | Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defender features |
| Rule name: | Macos_Infostealer_Wallets_8e469ea0 |
|---|---|
| Author: | Elastic Security |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (https://www.lukeacha.com) |
| Description: | Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| Rule name: | ThreadControl__Context |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.