🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81
SHA3-384 hash: a36fee95b839fb63160861515bd5dda8184e16d0a71209c6a0a431f262ae70256d940d45ce700709db6112ae1b1f17fb
SHA1 hash: d1751e798a834b2ca80661be679b98e63a84f622
MD5 hash: 1bfbaec4be1c9d7b6ae6d16bd2a8361f
humanhash: oregon-equal-potato-river
File name:1bfbaec4be1c9d7b6ae6d16bd2a8361f.exe
Download: download sample
Signature njrat
Create hunting rule
File size:511'564 bytes
First seen:2026-11-06 13:55:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
ssdeep 12288:dSMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMXnTppc6o7MMMMMMMMMMMMMMaaAMW0t:dSMMMMMMMMMMMMMMMrMMMMMMMMMMMMM1
TLSH T182B4E01222D9AEC3EA7C133123B2569092F5ED170122E70D3D9D715C0BF9787BB927A6
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 414545c0d4c05503 (39 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
198.22.204.17:19815

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
198.22.204.17:19815 https://threatfox.abuse.ch/ioc/2017606/

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
njrat
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-06 14:13:42 UTC
Tags:
auto-reg auto-startup rat njrat bladabindi
Link:
https://app.any.run/tasks/678f3851-652f-496c-abca-30a4446f5db2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97627/
Detection(s):
Win.Malware.Dynamer-7106860-0
Create hunting rule

Win.Trojan.15347129-1
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1b7fa1492c978625a2d97
Tags:
bladabindi autorun njrat
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating synchronization primitives
Creating a window
Gathering data
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-31T18:54:00Z UTC
Last seen:
2026-10-31T19:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f93d1bea-ba73-4eff-834e-7cc6e1ec42f0
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1999795
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Disables zone checking for all users
Drops PE files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1999795 Sample: x6dqUE1NAC.exe Startdate: 06/11/2026 Architecture: WINDOWS Score: 100 42 rails-yin.tun.ply.gg 2->42 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for dropped file 2->50 52 11 other signatures 2->52 10 x6dqUE1NAC.exe 7 2->10         started        13 Gerenciador de Janelas da   rea de Trabalho.exe 3 2->13         started        15 Gerenciador de Janelas da   rea de Trabalho.exe 2 2->15         started        17 Gerenciador de Janelas da   rea de Trabalho.exe 2 2->17         started        signatures3 process4 file5 36 C:\Users\user\AppData\Local\...\Software.exe, PE32 10->36 dropped 38 C:\Users\user\AppData\...\x6dqUE1NAC.exe.log, ASCII 10->38 dropped 19 Software.exe 1 7 10->19         started        23 sppsvc.exe 10->23         started        process6 file7 34 Gerenciador de Jan...rea de Trabalho.exe, PE32 19->34 dropped 54 Antivirus detection for dropped file 19->54 56 Multi AV Scanner detection for dropped file 19->56 25 Gerenciador de Janelas da   rea de Trabalho.exe 4 5 19->25         started        signatures8 process9 dnsIp10 44 rails-yin.tun.ply.gg 198.22.204.17, 19815 PLAYIT-GG-DevelopedMethodsLLCUS Brazil 25->44 40 C:\...\70240929ba8b2cc65462418012a913a8.exe, PE32 25->40 dropped 58 Protects its processes via BreakOnTermination flag 25->58 60 Disables zone checking for all users 25->60 62 Creates autostart registry keys with suspicious names 25->62 30 netsh.exe 2 25->30         started        file11 signatures12 process13 process14 32 conhost.exe 30->32         started       
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.45 Win 64 Exe x64
Link:
https://app.malva.re/file/1bfbaec4be1c9d7b6ae6d16bd2a8361f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81/
Threat name:
ByteCode-MSIL.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 21:04:27 UTC
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5yq3cywylemhqsjeluuiik7hktks7vdzjwkiyunmnseobooh2aq._file
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:teste defense_evasion discovery persistence privilege_escalation trojan
Link:
https://tria.ge/reports/261106-q77j2sby8x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Modifies Windows Firewall
Family: njRAT/Bladabindi
Malware Config
C2 Extraction:
rails-yin.tun.ply.gg:19815
Malware Family:
n/a
Verdict:
Malicious
Tags:
rat
YARA:
pe_no_import_table
Link:
https://app.threat.zone/submission/1f3f4699-590c-4ed7-8a39-aa5b184896bf
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
64bits dotnet overlay persistence calls-wmi obfuscated malware
Link:
https://intel.virussign.com/intelligence/file/8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81
Unpacked files
SH256 hash:
8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81
MD5 hash:
1bfbaec4be1c9d7b6ae6d16bd2a8361f
SHA1 hash:
d1751e798a834b2ca80661be679b98e63a84f622
Link:
https://www.unpac.me/results/7d10fd5f-86f2-40a9-9e73-c35245a9ea4a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f710d8b16c2c8c3c24922e944215f3aa6a97ea3ca6ca4628d63644705ce3e81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97627/

Comments