🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45d99d34f3dd06f66ecd249bcd53ba9e97fa6b52008c92dd6eb812580af6c760. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45d99d34f3dd06f66ecd249bcd53ba9e97fa6b52008c92dd6eb812580af6c760
SHA3-384 hash: faaab4afb2c5fc4ca5788bf1a83d43e171056ede55ac509495e32d5402fc09f8f4c418982ce5fb66b09afc451fb6e38e
SHA1 hash: 7f44bfe2d2d6508232a6d41afeaa174c181f8092
MD5 hash: e2a0863f3954d95f82b83c554378e87d
humanhash: venus-oranges-nebraska-sink
File name:script2.ps1
Download: download sample
Signature njrat
Create hunting rule
File size:3'682 bytes
First seen:2025-05-26 01:34:34 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 96:mdebm6qmzbBw0iX31/9d2/yuCa4p08Q1qQ:mdebbqYbBw93l267a/AQ
TLSH T140716359844A4C2647720B4D86A8F6CDFCB6053B5293BC00B06DB044FBFD64BA2D45BF
Magika powershell
Reporter skocherhan
Tags:archive-org Hof6 NjRAT ps1


Avatar
skocherhan
https://archive.org/download/script2_202503/script2.ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
GB GB
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6833c6d4acf88f5815e6eaaf
Tags:
ransomware autorun dropper sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper evasive evasive fingerprint installer overlay packed persistence
Link:
https://www.filescan.io/uploads/6833c557fd02ed5e05875d34/reports/4d084779-94e6-45ce-b5d8-a9ccf031bd0b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/45d99d34f3dd06f66ecd249bcd53ba9e97fa6b52008c92dd6eb812580af6c760
Result
Threat name:
Babadeda, Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1698930
Signature
.NET source code contains potential unpacker
Adds extensions / path to Windows Defender exclusion list (Registry)
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disables zone checking for all users
Drops PE files to the startup folder
Found malware configuration
Found Tor onion address
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Powershell drops PE file
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Uses cmd line tools excessively to alter registry or file data
Yara detected Babadeda
Yara detected Njrat
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1698930 Sample: script2.ps1 Startdate: 26/05/2025 Architecture: WINDOWS Score: 100 138 www.meldaproduction.com 2->138 140 raw.githubusercontent.com 2->140 142 4 other IPs or domains 2->142 156 Suricata IDS alerts for network traffic 2->156 158 Found malware configuration 2->158 160 Malicious sample detected (through community Yara rule) 2->160 162 10 other signatures 2->162 12 powershell.exe 16 35 2->12         started        17 WindowsSecurity.exe 2->17         started        19 WindowsSecurity.exe 2->19         started        21 2 other processes 2->21 signatures3 process4 dnsIp5 148 archive.org 207.241.224.2, 443, 49692 INTERNET-ARCHIVEUS United States 12->148 150 ia803203.us.archive.org 207.241.234.123, 443, 49693 INTERNET-ARCHIVEUS United States 12->150 152 2 other IPs or domains 12->152 114 C:\Users\user\AppData\WindowsSecurity.exe, PE32 12->114 dropped 116 C:\Users\user\AppData\SoundSemo.exe, PE32 12->116 dropped 118 C:\Users\user\AppData\System.bat, DOS 12->118 dropped 192 Found Tor onion address 12->192 194 Creates multiple autostart registry keys 12->194 196 Loading BitLocker PowerShell Module 12->196 198 Powershell drops PE file 12->198 23 WindowsSecurity.exe 8 12->23         started        27 SoundSemo.exe 12->27         started        29 cmd.exe 1 12->29         started        39 2 other processes 12->39 120 C:\Users\user\AppData\Local\Temp\...\1D80.bat, ASCII 17->120 dropped 31 cmd.exe 17->31         started        33 conhost.exe 17->33         started        122 C:\Users\user\AppData\Local\Temp\...\C057.bat, ASCII 19->122 dropped 35 cmd.exe 19->35         started        37 conhost.exe 19->37         started        file6 signatures7 process8 file9 100 C:\Users\user\AppData\Local\Temp\...\71DE.bat, ASCII 23->100 dropped 164 Multi AV Scanner detection for dropped file 23->164 41 cmd.exe 1 23->41         started        44 conhost.exe 23->44         started        102 C:\Users\user\AppData\Local\...\SoundSemo.tmp, PE32 27->102 dropped 46 SoundSemo.tmp 27->46         started        166 Uses cmd line tools excessively to alter registry or file data 29->166 49 reg.exe 1 1 29->49         started        51 net.exe 1 29->51         started        53 conhost.exe 29->53         started        168 Suspicious powershell command line found 31->168 170 Tries to download and execute files (via powershell) 31->170 55 powershell.exe 31->55         started        57 windows.exe 31->57         started        59 2 other processes 35->59 signatures10 process11 file12 174 Suspicious powershell command line found 41->174 176 Tries to download and execute files (via powershell) 41->176 61 windows.exe 2 7 41->61         started        65 powershell.exe 14 16 41->65         started        130 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 46->130 dropped 132 C:\ProgramData\...\is-86T47.tmp, PE32+ 46->132 dropped 134 C:\ProgramData\...\MPluginManager.exe (copy), PE32+ 46->134 dropped 136 2 other files (none is malicious) 46->136 dropped 67 MPluginManager.exe 46->67         started        178 Adds extensions / path to Windows Defender exclusion list (Registry) 49->178 70 net1.exe 1 51->70         started        signatures13 process14 dnsIp15 124 C:\Users\user\AppData\Roaming\Windows.exe, PE32 61->124 dropped 200 Multi AV Scanner detection for dropped file 61->200 202 Uses cmd line tools excessively to alter registry or file data 61->202 72 Windows.exe 4 6 61->72         started        77 attrib.exe 61->77         started        126 C:\Users\user\AppData\windows.exe, PE32 65->126 dropped 204 Powershell drops PE file 65->204 144 meldaproduction.com 52.29.75.84, 49708, 49709, 49710 AMAZON-02US United States 67->144 128 C:\Users\...\MPluginManager_02_04_setup.exe, PE32 67->128 dropped 79 MPluginManager_02_04_setup.exe 67->79         started        file16 signatures17 process18 dnsIp19 146 46.153.249.193, 443, 49703 MOBILY-ASEtihadEtisalatCompanyMobilySA Saudi Arabia 72->146 110 C:\Users\user\AppData\Roaming\...\Windows.exe, PE32 72->110 dropped 180 Multi AV Scanner detection for dropped file 72->180 182 Uses cmd line tools excessively to alter registry or file data 72->182 184 Disables zone checking for all users 72->184 190 2 other signatures 72->190 81 attrib.exe 72->81         started        83 attrib.exe 72->83         started        186 Suspicious powershell command line found 77->186 188 Tries to download and execute files (via powershell) 77->188 85 conhost.exe 77->85         started        112 C:\Users\...\MPluginManager_02_04_setup.tmp, PE32 79->112 dropped 87 MPluginManager_02_04_setup.tmp 79->87         started        file20 signatures21 process22 file23 91 conhost.exe 81->91         started        93 conhost.exe 83->93         started        104 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 87->104 dropped 106 C:\ProgramData\...\is-5DNPP.tmp, PE32+ 87->106 dropped 108 C:\Program Files\...\is-NUT7I.tmp, PE32 87->108 dropped 172 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 87->172 95 MPluginManager.exe 87->95         started        98 ie4uinit.exe 87->98         started        signatures24 process25 dnsIp26 154 127.0.0.1 unknown unknown 95->154
Score:
23%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/45d99d34f3dd06f66ecd249bcd53ba9e97fa6b52008c92dd6eb812580af6c760
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45d99d34f3dd06f66ecd249bcd53ba9e97fa6b52008c92dd6eb812580af6c760/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-03-14 08:16:19 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixmz2nht3udpm3wnesn42u52t2l7u22sacgjfxloxajfqcxwy5qa._file
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:hacked discovery execution persistence trojan
Link:
https://tria.ge/reports/250526-bzrrasvjv9/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
46.153.249.193:443
Dropper Extraction:
https://archive.org/download/pp_20250226/pp.bat
https://github.com/Hof6/R/raw/refs/heads/main/WindowsSecurity.exe
https://github.com/Hof6/R/raw/refs/heads/main/MPluginManager_01_19_setup.exe
https://github.com/Hof6/R/raw/refs/heads/main/Windows.exe
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments