MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 10

Intelligence 10 IOCs YARA 19 File information Comments

SHA256 hash:	216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b
SHA3-384 hash:	db3beb2c9b4c38469a2ed6d7f281d0834ed4ad4269a026ab96e4932000964938b8f05f21df443c8fde8d5f012c6c64f5
SHA1 hash:	cd8ca80611b8e414ca7b46510ace0333f8fefa6f
MD5 hash:	6096970d8df4fb2002688cfeb7b5899c
humanhash:	hawaii-salami-may-undress
File name:	kbhzs.ps1
Download:	download sample
Signature	njrat Create hunting rule
File size:	317'074 bytes
First seen:	2025-12-07 21:22:06 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3072:yWKtinhk29Ll0jQkEV38XEUkIncq+sI62AtgCrP8IS84HVqBgmA3koUGQV86+x7u:S
Threatray	65 similar samples on MalwareBazaar
TLSH	T14364CC3DCFE8962FC277CE19CDCB4A03F8950D5A221CE98F64D363A752161927CA216D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	Anonymous
Tags:	NjRAT ps1

Intelligence

File Origin

# of uploads :

# of downloads :

119

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6935f009c61465c74cbc0f8a

Tags:

shell spawn sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive reconnaissance

Link:

https://www.filescan.io/uploads/6935f007bc15eab491f67a8c/reports/194f4021-bd2c-4f68-8e62-addf101d7d4b/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-07T18:48:00Z UTC

Last seen:

2025-12-07T20:17:00Z UTC

Hits:

~10

Detections:

Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Gorgon.sb Backdoor.Win32.Androm Backdoor.MSIL.SpyGate.sb Backdoor.MSIL.Bladabindi.sb Backdoor.Agent.TCP.C&C Backdoor.MSIL.Bladabindi.q Backdoor.Bladabindi.TCP.C&C Backdoor.Agent.HTTP.C&C Trojan.MSIL.Dnoper.sb Backdoor.SpyGate.TCP.C&C

Link:

https://opentip.kaspersky.com/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated PowerShell

Link:

https://app.malva.re/file/6096970d8df4fb2002688cfeb7b5899c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b/

Verdict:

Malicious

Threat:

Backdoor.Win32.Bladabindi

Link:

https://tip.neiki.dev/file/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=efvtywptzdy34ltgd6lc5mv7lx4jgpufhf5cyofzvwbnxd3wbfnq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/251207-z7znwayqex/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Modifies Windows Firewall

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/216b3c59f3c8f1be2e661f962eb2bf5df8933e85397a2c38b9ad82db8f76095b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_c Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	CN_disclosed_20180208_c_RID2E71 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	malware_Njrat_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect njRAT in memory

Rule name:	MALWARE_Win_NjRAT Create hunting rule
Author:	ditekSHen
Description:	Detects NjRAT / Bladabindi / NjRAT Golden

Rule name:	MAL_njrat Create hunting rule
Author:	SECUINFRA Falcon Team

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_LightDefender_Njrat_Rule Create hunting rule
Author:	Skystars LightDefender
Description:	Detects Njrat

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_netsh_firewall_command Create hunting rule
Author:	SECUINFRA Falcon Team

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Windows_Trojan_Njrat_30f3c220 Create hunting rule

Rule name:	win_njrat_strings_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

Rule name:	win_njrat_w1 Create hunting rule
Author:	Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:	Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample