🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 16


Intelligence 16 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815
SHA3-384 hash: 78148ba416cd5248fce913066009c8b0372178a5424a8518312c0b6b8a7b4791e2b99a6b5d7527d51a605422e6f1c371
SHA1 hash: 9b69ae0cd6c19534e468f0c3616af680dd887445
MD5 hash: b7ba3e0d0b59d704526b7ba31af583dc
humanhash: snake-tennis-delta-east
File name:virus.exe.bin
Download: download sample
Signature njrat
Create hunting rule
File size:6'809'900 bytes
First seen:2025-03-21 22:07:34 UTC
Last seen:2025-03-22 16:14:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 98304:p08hJKKTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRR3:p08hJbTVHJack+YlGlSRR3
Threatray 40 similar samples on MalwareBazaar
TLSH T1A066F123B6D56532F4BF2732B8A20435377EA48CE043AB9A24A457D6BC72F084F46757
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 595554d44555ccf0 (2 x njrat)
Reporter KatzenTech
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
558
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
njrat
Create hunting rule
ID:
1
File name:
virus.exe
Verdict:
Malicious activity
Analysis date:
2025-03-21 17:49:20 UTC
Tags:
evasion java discord exfiltration stealer rat njrat bladabindi remote backdoor
Link:
https://app.any.run/tasks/572b69b6-626f-44ea-bb16-6ce065e562d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67dde4d0518d210202e7c09a
Tags:
bladabindi njrat
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Launching a process
Creating a process with a hidden window
DNS request
Connection attempt
Sending a custom TCP request
Searching for synchronization primitives
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
Creating a file in the mass storage device
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Adding exclusions to Windows Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd dllhost explorer hacktool lolbin masquerade njrat obfuscated overlay packed packer_detected rat reconnaissance rundll32 schtasks vbnet windows
Link:
https://www.filescan.io/uploads/67dde35c195c2ecf47ef2d43/reports/72e0bc1d-d17a-4812-834d-5c3a3ae0b614/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3063d211-e464-4325-97e6-12eb259d1436
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.bank.troj.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1645584
Signature
.NET source code contains a sample name check
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Disables zone checking for all users
Drops PE files to the startup folder
Encrypted powershell cmdline option found
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious encrypted Powershell command line found
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Protects its processes via BreakOnTermination flag
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potentially Suspicious Malware Callback Communication
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1645584 Sample: virus.exe.bin.exe Startdate: 21/03/2025 Architecture: WINDOWS Score: 100 87 gabh.gotdns.ch 2->87 89 github.com 2->89 91 2 other IPs or domains 2->91 101 Suricata IDS alerts for network traffic 2->101 103 Found malware configuration 2->103 105 Malicious sample detected (through community Yara rule) 2->105 107 20 other signatures 2->107 11 virus.exe.bin.exe 3 9 2->11         started        15 dllhost.exe 2->15         started        17 dllhost.exe 2->17         started        19 2 other processes 2->19 signatures3 process4 file5 77 C:\Users\user\AppData\Local\Temp\...\Hyra.exe, PE32 11->77 dropped 79 C:\Users\user\AppData\Local\Temp\...\ere.js, ASCII 11->79 dropped 81 C:\Users\user\...\virus.exe.bin.exe.log, ASCII 11->81 dropped 139 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 11->139 21 Hyra.exe 2 6 11->21         started        25 wscript.exe 1 1 11->25         started        signatures6 process7 file8 75 C:\Users\user\AppData\Local\...\final.exe, PE32 21->75 dropped 129 Antivirus detection for dropped file 21->129 27 final.exe 21->27         started        31 javaw.exe 21->31         started        131 Malicious encrypted Powershell command line found 25->131 133 Wscript starts Powershell (via cmd or directly) 25->133 135 Encrypted powershell cmdline option found 25->135 137 2 other signatures 25->137 33 wscript.exe 1 25->33         started        signatures9 process10 file11 83 C:\Users\user\AppData\Local\...\webhook.exe, PE32 27->83 dropped 85 C:\Users\user\AppData\Local\...\Payload.exe, PE32 27->85 dropped 141 Antivirus detection for dropped file 27->141 35 Payload.exe 27->35         started        39 webhook.exe 27->39         started        42 icacls.exe 31->42         started        143 Malicious encrypted Powershell command line found 33->143 145 Wscript starts Powershell (via cmd or directly) 33->145 147 Encrypted powershell cmdline option found 33->147 149 Windows Scripting host queries suspicious COM object (likely to drop second stage) 33->149 44 powershell.exe 7 33->44         started        46 powershell.exe 14 16 33->46         started        48 powershell.exe 7 33->48         started        signatures12 process13 dnsIp14 69 C:\Users\user\AppData\Roaming\dllhost.exe, PE32 35->69 dropped 71 C:\ClickMe.exe, PE32 35->71 dropped 109 Antivirus detection for dropped file 35->109 111 Multi AV Scanner detection for dropped file 35->111 50 dllhost.exe 35->50         started        95 discordapp.com 162.159.129.233, 443, 49684 CLOUDFLARENETUS United States 39->95 97 api.ipify.org 172.67.74.152, 443, 49682, 49683 CLOUDFLARENETUS United States 39->97 55 conhost.exe 42->55         started        113 Adds a directory exclusion to Windows Defender 44->113 57 powershell.exe 44->57         started        59 conhost.exe 44->59         started        99 github.com 140.82.113.3, 443, 49685 GITHUBUS United States 46->99 115 Potential dropper URLs found in powershell memory 46->115 61 conhost.exe 46->61         started        63 reg.exe 48->63         started        65 conhost.exe 48->65         started        file15 signatures16 process17 dnsIp18 93 gabh.gotdns.ch 46.121.250.34, 49691, 49693, 7777 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste Israel 50->93 73 C:\...\c382eb151c59bd833b24120723eac541.exe, PE32 50->73 dropped 117 Antivirus detection for dropped file 50->117 119 System process connects to network (likely due to code injection or exploit) 50->119 121 Multi AV Scanner detection for dropped file 50->121 127 4 other signatures 50->127 123 Loading BitLocker PowerShell Module 57->123 67 WmiPrvSE.exe 57->67         started        125 Adds extensions / path to Windows Defender exclusion list (Registry) 63->125 file19 signatures20 process21
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815/
Threat name:
ByteCode-MSIL.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2025-03-21 22:08:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ne4yqmqhnutg2supycgtnykq2oozo3vjhy54aoxs4fmecb6y7akq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
3a36ea228a2f251f0f6bacdf0831428f629e44a8d9736eb4b47307e59d6bb8f2
njrat
69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815
njrat
92878cdf6771032cedff027921afbec33c57acffc2203f9a03248343dbc7bdf2
njrat
97d8da6df2393f88c7a4b101dd496add87bd218a859b5116fddd253e05cfbd97
njrat
b45689d589d6e53943196c4fc67552d465b057d3f76546fb7b11a786e3a388e4
njrat
ece230bd3c6294d5e194ebd36d26ffdbe7e0ce7681b920713224b3742f7498c2
njrat
error
njrat
fdc9eedb3f893ff020f9bfd48c87cd69fb0da4acd86370d0fbc6b7a52cb7df0a
njrat
+ 30 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat discovery execution persistence trojan
Link:
https://tria.ge/reports/250321-119qyavps4/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Njrat family
njRAT/Bladabindi
Malware Config
Dropper Extraction:
https://github.com/AnonAm0369/am/raw/refs/heads/main/RuntimeBroker.exe
Gathering data
Unpacked files
SH256 hash:
69398832076d266d4a8fc08d36e150d39d976ea93e3bc03af2e1584107d8f815
MD5 hash:
b7ba3e0d0b59d704526b7ba31af583dc
SHA1 hash:
9b69ae0cd6c19534e468f0c3616af680dd887445
Detections:
win_njrat_w1
Create hunting rule
NjRat
Create hunting rule
Link:
https://www.unpac.me/results/7a265745-df03-493c-8af9-3d2e4d07c665/
SH256 hash:
780bf370f55bed41c91e40a07db66bf12059f38e8ad1b9481da1748bea29ff48
MD5 hash:
4ce347196ee1d687888195dc13f9859c
SHA1 hash:
2784b1c3c06203b31915da958554340991223e9d
Link:
https://www.unpac.me/results/7a265745-df03-493c-8af9-3d2e4d07c665/
SH256 hash:
91e595f7b7bd739921ec15581eb3e56ca7d8054dc8983a505f41d2d600c6b83e
MD5 hash:
c94a477754f8487f5ce9df9aaa037157
SHA1 hash:
39600b40dacd804792547aceb945166734e9f77d
Detections:
win_njrat_w1
Create hunting rule
NjRat
Create hunting rule
MAL_Winnti_Sample_May18_1
Create hunting rule
CN_disclosed_20180208_c
Create hunting rule
Unknown_Malware_Sample_Jul17_2
Create hunting rule
Njrat
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
MALWARE_Win_NjRAT
Create hunting rule
Link:
https://www.unpac.me/results/7a265745-df03-493c-8af9-3d2e4d07c665/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69398832076d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables (downlaoders) containing URLs to raw contents of a paste
Rule name:malware_Njrat_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:MALWARE_Win_NjRAT
Create hunting rule
Author:ditekSHen
Description:Detects NjRAT / Bladabindi / NjRAT Golden
Rule name:MAL_njrat
Create hunting rule
Author:SECUINFRA Falcon Team
Rule name:Mal_WIN_NjRAT_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect NjRAT implant.
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Njrat_30f3c220
Create hunting rule
Rule name:Windows_Trojan_Njrat_30f3c220
Create hunting rule
Author:Elastic Security
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments