🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697
SHA3-384 hash: 4d8aafc0bb26a0b8a1779edfd9270c5851247d2849680c090432a3bd3737b1ac52036ad10e580a02cf72dc69044e542b
SHA1 hash: c6563fe931c696d22e9b59910a5a8babbd6cc187
MD5 hash: 95d223d4377e594219f4cfe238e6699f
humanhash: nuts-violet-fifteen-bravo
File name:kmsservice.js
Download: download sample
Signature njrat
Create hunting rule
File size:12'902 bytes
First seen:2026-01-07 21:56:30 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:P/70WOy+65k0+iUH7nsZ7iNMsCIHGtC3j7iU0gfxvsCtm3G0ussiEkm:P/YW/5k0+iUHTZCIHGtC3j7iU0gFsCtf
Threatray 243 similar samples on MalwareBazaar
TLSH T13642E9EFBC00A066624753676F3D9CD0D3667C64E6CC6C6F8194AA86A443D389DFB530
Magika javascript
Reporter smica83
Tags:js NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695ed6bb9922425f92fe8519
Tags:
autorun shell sage blic
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive obfuscated reconnaissance repaired
Link:
https://www.filescan.io/uploads/695ed6ba6c34f71773c59258/reports/cf97663e-0d87-49d4-96c2-f9a828ee7cb4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697
Verdict:
Malicious
File Type:
js
First seen:
2025-09-13T03:38:00Z UTC
Last seen:
2026-01-07T16:38:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Script.Generic Trojan-Downloader.VBS.SLoad.sb Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.expl
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1846356
Signature
Drops script or batch files to the startup folder
JScript performs obfuscated calls to suspicious functions
Potential obfuscated javascript found
Sigma detected: Drops script at startup location
Sigma detected: Powershell download and execute file
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1846356 Sample: kmsservice.js Startdate: 07/01/2026 Architecture: WINDOWS Score: 92 45 upaste.me 2->45 49 Sigma detected: Powershell download and execute file 2->49 51 Yara detected Powershell download and execute 2->51 53 Sigma detected: Drops script at startup location 2->53 55 2 other signatures 2->55 9 wscript.exe 1 1 2->9         started        12 wscript.exe 1 2->12         started        signatures3 process4 signatures5 59 JScript performs obfuscated calls to suspicious functions 9->59 61 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->61 63 Suspicious execution chain found 9->63 14 cscript.exe 2 2 9->14         started        16 cscript.exe 2 12->16         started        process6 process7 18 xcopy.exe 3 14->18         started        22 powershell.exe 15 16 14->22         started        25 conhost.exe 14->25         started        27 xcopy.exe 1 16->27         started        29 powershell.exe 16->29         started        31 conhost.exe 16->31         started        dnsIp8 41 C:\Users\...\kmsservice.js:Zone.Identifier, ASCII 18->41 dropped 43 C:\Users\user\AppData\...\kmsservice.js, ASCII 18->43 dropped 57 Drops script or batch files to the startup folder 18->57 33 conhost.exe 18->33         started        47 upaste.me 104.21.45.216, 443, 49723, 49730 CLOUDFLARENETUS United States 22->47 35 conhost.exe 22->35         started        37 conhost.exe 27->37         started        39 conhost.exe 29->39         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697
Gathering data
Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697/
Verdict:
Malicious
Threat:
Trojan-Downloader.VBS.SLoad
Link:
https://tip.neiki.dev/file/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697
Threat name:
Script-JS.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-07 21:57:15 UTC
File Type:
Text (JavaScript)
AV detection:
4 of 23 (17.39%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eboar7yyb2zy5chfou6u7ygsw5tnfuasmjmu6qlah3jq23mw62lq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
53d52508d4fbf502264ff4e8482ff3c988f86f4727326d09a71724b61a152e92
njrat
c411f481563dd48db8a218e063da6477062a9cb628d50c666009ad9040dfde21
njrat
d34e5303fc26aa9717e1cf74af1be51b527eea796e066a7c049866e9126b4172
njrat
ef2e8058072b7d590f8ac4796487db839cc60064151c136bfa58213c87f016d4
njrat
error
njrat
+ 233 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:kms defense_evasion discovery execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/260107-1t1jpadx8f/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Drops startup file
Badlisted process makes network request
Modifies Windows Firewall
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
fatisabi.linkpc.net:5552
Dropper Extraction:
https://upaste.me/r/2e0f59776ad8d22d3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/205c08ff180eb38e88e5753d4fe0d2b766d2d01262594f41603ed30d6d96f697

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments