🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a
SHA3-384 hash: 799871886a8428afa8efe4b68236866299d3e5b1314332ad162de25eec8df1a16e95f8f491de5a914fb485f648433b52
SHA1 hash: f4810afda0130dc2793f9b932a7f773668380289
MD5 hash: 08b02f59c18918817fbd1923cbca6073
humanhash: berlin-nine-leopard-ohio
File name:csbat.exe
Download: download sample
Signature njrat
Create hunting rule
File size:436'736 bytes
First seen:2025-05-22 01:19:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d5d9d937853db8b666bd4b525813d7bd (41 x DCRat, 28 x njrat, 5 x RedLineStealer)
ssdeep 12288:LsbQJ60WyhwCenKhZfwPaGixW25qPIinnqJMJU7:o2RWyhncKhOJj9PIie
Threatray 352 similar samples on MalwareBazaar
TLSH T172940211324E9679D808BCFFE40758764EA62C909F5C186953B9F23909F76B3CC8E64E
TrID 83.6% (.EXE) Win32 Executable MS Visual C++ 4.x (134693/65)
4.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.7% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 1633716159792333 (1 x njrat)
Reporter skocherhan
Tags:exe MommyNikiits NjRAT


Avatar
skocherhan
https://github.com/MommyNikiits/Sector2/raw/refs/heads/master/csbat.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
525
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
darkcomet
Create hunting rule
ID:
1
File name:
csbat.exe
Verdict:
Malicious activity
Analysis date:
2025-05-22 01:21:36 UTC
Tags:
darkcomet rat auto njrat auto-startup bladabindi auto-reg upx antivm delphi
Link:
https://app.any.run/tasks/6538d96f-30ab-4d4c-a724-dfd761e3e053

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682e7e302f280a98fb4318f7
Tags:
autorun emotet xorist njrat
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Creating a file
Enabling the 'hidden' option for files in the %temp% directory
Launching cmd.exe command interpreter
Creating a process with a hidden window
Launching a process
Searching for synchronization primitives
Connection attempt
DNS request
Enabling the 'hidden' option for recently created files
Setting a keyboard event handler
Searching for the window
Searching for the Windows task manager window
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Enabling autorun
Enabling autorun by creating a file
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin packed packed packer_detected remote
Link:
https://www.filescan.io/uploads/682e7be0fd02ed5e05815665/reports/3a92d1b1-6bcb-4c5d-adc8-bc830e5a9e06/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Injector
Link:
https://www.hybrid-analysis.com/sample/53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4af2012c-2cb4-4be2-b194-67b6e8dad405
Result
Threat name:
DarkComet, Njrat
Create hunting rule
Detection:
malicious
Classification:
rans.spre.phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1696441
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Contains functionality to spread to USB devices (.Net source)
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Disables zone checking for all users
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potentially Suspicious Malware Callback Communication
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected DarkComet
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1696441 Sample: csbat.exe Startdate: 22/05/2025 Architecture: WINDOWS Score: 100 55 ggdropnet.ddns.net 2->55 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for dropped file 2->63 67 12 other signatures 2->67 9 csbat.exe 10 2->9         started        13 msdcsc.exe 2->13         started        15 Device2.exe 2->15         started        17 3 other processes 2->17 signatures3 65 Uses dynamic DNS services 55->65 process4 file5 51 C:\Users\user\AppData\Local\...\scrcabat.scr, PE32 9->51 dropped 53 C:\Users\user\AppData\Local\...\Device2.exe, PE32 9->53 dropped 85 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 9->85 87 Drops PE files with a suspicious file extension 9->87 19 scrcabat.scr 1 3 9->19         started        23 Device2.exe 7 5 9->23         started        26 conhost.exe 9->26         started        signatures6 process7 dnsIp8 47 C:\Users\user\AppData\Local\...\msdcsc.exe, PE32 19->47 dropped 69 Antivirus detection for dropped file 19->69 71 Multi AV Scanner detection for dropped file 19->71 73 Creates an undocumented autostart registry key 19->73 81 6 other signatures 19->81 28 msdcsc.exe 3 19->28         started        31 cmd.exe 1 19->31         started        33 cmd.exe 1 19->33         started        57 26.151.148.22, 2111, 4433 COMCAST-7922US United States 23->57 49 C:\...\5a58f9242b64263df668b949c7294533.exe, PE32 23->49 dropped 75 Changes the view of files in windows explorer (hidden files and folders) 23->75 77 Disables zone checking for all users 23->77 79 Creates autostart registry keys with suspicious names 23->79 83 4 other signatures 23->83 35 netsh.exe 23->35         started        file9 signatures10 process11 signatures12 89 Antivirus detection for dropped file 28->89 91 Multi AV Scanner detection for dropped file 28->91 93 Writes to foreign memory regions 28->93 97 4 other signatures 28->97 37 notepad.exe 5 28->37         started        95 Uses cmd line tools excessively to alter registry or file data 31->95 39 conhost.exe 31->39         started        41 attrib.exe 1 31->41         started        43 conhost.exe 33->43         started        45 attrib.exe 1 33->45         started        process13
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a
Detection:
darkcomet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a/
Threat name:
Win32.Trojan.VBinder
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 15:07:21 UTC
AV detection:
38 of 41 (92.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kn3c4kzb26lvkl5dk2lkjyd75r2yiadqv2746j5oiss4dq2rqq5a._file
Verdict:
malicious
Label(s):
unc_loader_033
Create hunting rule
Similar samples:
1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64
njrat
76f3f11f6edda541fc77ef2354e5f199db8c5513b3ccf55d62dd7d64b58850c4
njrat
a2f4d3da25e52d88eafb7a7da242e9bb507fe4626af58ca3b8c1a13e391c2000
njrat
a6184cc11ae5e53a2c52fc668690561b0ed9b7217e0ff7c0b236bce30fba1da3
njrat
b61182634b32940e012d1551df9983cf12b53816c89ccfe8c68b185767362a20
njrat
c60f851e1c3194fa5d7f6e8a71d9f8d9cad5b78072ec1e764d19345a3f877423
njrat
f52cc86d7cf14cdc0c501285f31418a702fb88fceb639e5c4b295f9d9bcadb29
njrat
fa3981228b5b124a8b51fa64f8b6d5d05899165647dc50322b717d7ab63d4997
njrat
+ 342 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet botnet:ïåðå defense_evasion discovery persistence privilege_escalation rat trojan upx
Link:
https://tria.ge/reports/250522-bqb99adp61/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
UPX packed file
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Modifies Windows Firewall
Sets file to hidden
Darkcomet
Darkcomet family
Modifies WinLogon for persistence
Malware Config
C2 Extraction:
ggdropnet.ddns.net:4433
ggdropnet.ddns.net:2111
Unpacked files
SH256 hash:
53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a
MD5 hash:
08b02f59c18918817fbd1923cbca6073
SHA1 hash:
f4810afda0130dc2793f9b932a7f773668380289
Link:
https://www.unpac.me/results/b156d13a-05a5-4b20-a85d-d17e156d144e/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/53762e2b21d7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53762e2b21d797552fa35696a4e07fec75840070aebfcf27ae44a5c1c351843a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments