🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 621666d2d94d0e995bc0b62165d7c8700b236a3ab99e857fd0f215ce72b23d09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 8


Intelligence 8 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 621666d2d94d0e995bc0b62165d7c8700b236a3ab99e857fd0f215ce72b23d09
SHA3-384 hash: 57ec57a84b3e76a1d6236ca56522d9cbfc0cda3ce1ccbe7d62db707450ddac369db7de0e5aa1dc07d095fd28001402d5
SHA1 hash: 8642d5f1fce25f255ecdf9371639f48dc88dd312
MD5 hash: ba7ec6b54577864a8c340ca8c31f5c84
humanhash: seventeen-apart-orange-august
File name:script.ps1
Download: download sample
Signature njrat
Create hunting rule
File size:769'568 bytes
First seen:2025-05-26 01:24:46 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:FbDCanWJR55VKr7gUZVsIYJjD2N1/S/kplRWuacHFJtX/8HX5X3YrMjRCKVLTCHH:lsIYkwcH6pG+RCHLK4
Threatray 3'418 similar samples on MalwareBazaar
TLSH T1C3F40833EA444E3356B2532AAD9B4646FB1503BF92101D0A78FC814C5FB265F8177FAA
Magika powershell
Reporter skocherhan
Tags:archive-org Hof6 NjRAT ps1


Avatar
skocherhan
https://archive.org/download/script_202504/script.ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
GB GB
Vendor Threat Intelligence
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6833c530acf88f5815e6e5b2
Tags:
bladabindi vmdetect autorun njrat
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm base64 dropper evasive evasive fingerprint packed stealer
Link:
https://www.filescan.io/uploads/6833c2fae336a33801de06af/reports/64e7470f-a33d-41f9-8e4d-4201340e9a56/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/621666d2d94d0e995bc0b62165d7c8700b236a3ab99e857fd0f215ce72b23d09
Result
Threat name:
Babadeda, Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1698927
Signature
.NET source code contains potential unpacker
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Disables zone checking for all users
Drops PE files to the startup folder
Found malware configuration
Found Tor onion address
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses cmd line tools excessively to alter registry or file data
Yara detected Babadeda
Yara detected Njrat
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1698927 Sample: script.ps1 Startdate: 26/05/2025 Architecture: WINDOWS Score: 100 85 raw.githubusercontent.com 2->85 87 images.emojiterra.com 2->87 89 6 other IPs or domains 2->89 107 Suricata IDS alerts for network traffic 2->107 109 Found malware configuration 2->109 111 Malicious sample detected (through community Yara rule) 2->111 113 12 other signatures 2->113 12 powershell.exe 16 73 2->12         started        17 svchost.exe 1 1 2->17         started        19 Windows.exe 2->19         started        21 Windows.exe 2->21         started        signatures3 process4 dnsIp5 93 archive.org 207.241.224.2, 443, 49715 INTERNET-ARCHIVEUS United States 12->93 95 ia903203.us.archive.org 207.241.234.113, 443, 49716 INTERNET-ARCHIVEUS United States 12->95 99 4 other IPs or domains 12->99 77 C:\Users\user\AppData\WindowsSecurity.exe, PE32 12->77 dropped 79 C:\Users\user\AppData\...\3cbkzoaa.cmdline, Unicode 12->79 dropped 127 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->127 129 Query firmware table information (likely to detect VMs) 12->129 131 Found Tor onion address 12->131 133 2 other signatures 12->133 23 WindowsSecurity.exe 8 12->23         started        27 cmd.exe 1 12->27         started        29 csc.exe 12->29         started        31 2 other processes 12->31 97 127.0.0.1 unknown unknown 17->97 file6 signatures7 process8 file9 71 C:\Users\user\AppData\Local\Temp\...\3CB2.bat, ASCII 23->71 dropped 115 Multi AV Scanner detection for dropped file 23->115 33 cmd.exe 1 23->33         started        36 conhost.exe 23->36         started        117 Uses cmd line tools excessively to alter registry or file data 27->117 38 reg.exe 1 1 27->38         started        40 net.exe 1 27->40         started        42 conhost.exe 27->42         started        73 C:\Users\user\AppData\Local\...\3cbkzoaa.dll, PE32 29->73 dropped 44 cvtres.exe 29->44         started        signatures10 process11 signatures12 101 Suspicious powershell command line found 33->101 103 Tries to download and execute files (via powershell) 33->103 46 windows.exe 33->46         started        50 powershell.exe 14 16 33->50         started        105 Adds extensions / path to Windows Defender exclusion list (Registry) 38->105 52 net1.exe 1 40->52         started        process13 file14 81 C:\Users\user\AppData\Roaming\Windows.exe, PE32 46->81 dropped 135 Antivirus detection for dropped file 46->135 137 Multi AV Scanner detection for dropped file 46->137 139 Uses cmd line tools excessively to alter registry or file data 46->139 54 Windows.exe 46->54         started        59 attrib.exe 46->59         started        83 C:\Users\user\AppData\windows.exe, PE32 50->83 dropped 141 Powershell drops PE file 50->141 signatures15 process16 dnsIp17 91 46.153.249.193, 443, 49731 MOBILY-ASEtihadEtisalatCompanyMobilySA Saudi Arabia 54->91 75 C:\Users\user\AppData\Roaming\...\Windows.exe, PE32 54->75 dropped 119 Antivirus detection for dropped file 54->119 121 Multi AV Scanner detection for dropped file 54->121 123 Uses cmd line tools excessively to alter registry or file data 54->123 125 3 other signatures 54->125 61 attrib.exe 54->61         started        63 attrib.exe 54->63         started        65 conhost.exe 59->65         started        file18 signatures19 process20 process21 67 conhost.exe 61->67         started        69 conhost.exe 63->69         started       
Score:
5%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/621666d2d94d0e995bc0b62165d7c8700b236a3ab99e857fd0f215ce72b23d09
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/621666d2d94d0e995bc0b62165d7c8700b236a3ab99e857fd0f215ce72b23d09/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-14 18:11:10 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=milgnuwzjuhjsw6awyqwlv6ioafsg2r2xgpik76q6ik444vshueq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
184cc07e9c17fb1575bc37cda2b225299b5f479b73492165e07ce9ff0d9a7177
njrat
96a793550c288f00f404379fd88305b002888d92cf22e1f43403834fbfb00766
njrat
af2d5ae5ed7a72a3fa6a36cda93e163b84d8ad70a78afb08bcd1afa63d54f61e
njrat
b37508a2880228db684f461822c955304158e1e4bf210ebb4892466d81d5941c
njrat
c1275a93bd767e100a37e8bc22439be45698a733f71d1ba5c890f5b1b4c3e034
njrat
error
njrat
fd4dd04fc93e026a69f642e85d2b9d56ccc144994d35496d0090bde17d13d2b9
njrat
+ 3'408 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:hacked discovery execution persistence trojan
Link:
https://tria.ge/reports/250526-bs2ypatr12/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Njrat family
njRAT/Bladabindi
Malware Config
C2 Extraction:
46.153.249.193:443
Dropper Extraction:
https://archive.org/download/pp_20250226/pp.bat
https://github.com/Hof6/R/raw/refs/heads/main/WindowsSecurity.exe
https://github.com/Hof6/R/raw/refs/heads/main/Windows.exe
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:Detect_Zoom_Invite_malware_RAT_C2
Create hunting rule
Author:daniyyell
Description:Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:golang
Create hunting rule
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SUSP_Scheduled_Tasks_Create_From_Susp_Dir
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments