Concrete signature match: Trojan - Appears legitimate but performs malicious actions for .NET (Microsoft Intermediate Language) platform, family NjRat
This detection identifies a variant of the NjRat Remote Access Trojan (RAT), a malicious program that gives an attacker complete control over the infected system. The malware was identified through behavioral analysis when a legitimate Windows tool (RegAsm.exe) was used to execute a malicious payload, a common defense evasion technique.
No detailed analysis available from definition files.
a9ff4fbde5bb27981136ca2902000af76636fa327fdfcae50f3de411cbb9f5e1ec77a80a984c029be6242314bce682b5234783801f4dbe449b250e0198bcbf262bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb467ad7cc014c2098f96b7fb681cfda600bb614f2eeb68fd296b70dfd961d02dfb69c825f72a6a7630a356a90f5a4ca044960c475964a75d7c743ac0466dd81b41. Isolate the host from the network immediately to sever command and control. 2. Use antivirus to run a full scan and remove the detected payload and any related components. 3. Investigate and remove persistence mechanisms (e.g., Registry Run keys, Scheduled Tasks). 4. Reset all passwords for accounts used on the machine from a separate, trusted device.