MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda
SHA3-384 hash:	1cc58b22f414256d8da3ea786b56a77e58526dc7d7ff5f3c9dec32234ac14e9435be54f9e133903c7c782d5ce5370173
SHA1 hash:	2a95fdbc2ae9e8e8bdd27a5928c5723a4a61b4ea
MD5 hash:	e688e27c047b412afe7480a6c1bb29fa
humanhash:	lemon-wyoming-uranus-ink
File name:	meto_dropper.vbs
Download:	download sample
Signature	njrat Alert Create hunting rule
File size:	193'394 bytes
First seen:	2025-12-06 13:21:42 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	3072:9OaquQTjhhcLWdkBdxNKvjVcq98eMTY88Urg9LJ:9RtLhdx0vjVcq9BmmV
Threatray	687 similar samples on MalwareBazaar
TLSH	T196145B722613FDCA67BE3D80F65439D20C4D39A38B229658FAC41D6B35E62A4CF1D4E4
Magika	vba
Reporter	BlinkzSec
Tags:	NjRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

101

Origin country :

GB

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox Neshta

Detection:

Neshta

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/42732/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.Base64EXE-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69342e08c61465c74cbc0066

Tags:

bladabindi neshta emotet njrat

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 cmd dllhost dropper evasive explorer fingerprint fingerprint lolbin msconfig netsh njrat njrat obfuscated obfuscated overlay packed rat schtasks update windows

Link:

https://www.filescan.io/uploads/69342e06bba50eaf04244e66/reports/98b850f2-4fec-4799-b9ee-ef62f2ef5bcc/overview

Hybrid Analysis Nestha.C

Verdict:

Malicious

Labled as:

Nestha.C

Link:

https://www.hybrid-analysis.com/sample/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2025-12-06T10:28:00Z UTC

Last seen:

2025-12-07T21:52:00Z UTC

Hits:

~10

Detections:

Virus.Win32.Neshta.b Trojan.VBS.SAgent.sb HEUR:Worm.Win32.Generic HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan.MSIL.Crypt.gen PDM:Trojan.Win32.Generic Packed.Win32.Dico.gen HEUR:Virus.Win32.Infector Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.VBS.SLoad.sb Trojan.Win32.Agent.sb BSS:Trojan.Win32.Bazon.a Trojan-Downloader.JS.Cryptoload.sb Trojan.Win32.Gorgon.sb HEUR:Trojan.Win32.Generic Trojan.MSIL.Agent.sb HEUR:Trojan.Script.Generic not-a-virus:BSS:RiskTool.Win32.BitCoinMiner.g.1 not-a-virus:BSS:Downloader.Win32.LMN.d Backdoor.Bladabindi.TCP.ServerRequest Backdoor.Bladabindi.TCP.C&C Trojan.MSIL.DOTHETUK.sb Backdoor.MSIL.Coringa.sb

Link:

https://opentip.kaspersky.com/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

ADODB.Stream MSXML2.DOMDocument VBScript WScript.Shell

Link:

https://app.malva.re/file/e688e27c047b412afe7480a6c1bb29fa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda/

Neiki Family.NESHTA

Verdict:

Malicious

Threat:

Family.NESHTA

Link:

https://tip.neiki.dev/file/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

ReversingLabs TitaniumCloud Win32.Virus.Neshta

Threat name:

Win32.Virus.Neshta

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-06 13:12:51 UTC

File Type:

Text (VBS)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s453zriml3ftxyzhycfeifavggbxzftf7vuxucvtlidxp3hgftna._file

Threatray neshta njrat

Verdict:

malicious

Label(s):

neshta

Alert

Create hunting rule

njrat

Alert

Create hunting rule

Similar samples:

2e5f0664ba688ffe64eb0e50250826162e0c138f2d25a6e8c1c66396f1585782

njrat

427076ff4c7d7ba7dfbcf1695b271a893b5cc404d1338248f3bc9e2a209d7e14

njrat

973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

njrat

b8574f751902021929a8fbd4948cdded938006e0eaeacdb9231f8274080d5679

njrat

e4c6311e88083ab971d7d8d3c622221eadb86564654b8f20cc0e8159d61054d0

njrat

error

njrat

fb46b4afecf906742432eca80cb926f2d31a20c4e0f1628d9c909e28bfaa02d3

njrat

+ 677 additional samples on MalwareBazaar

Hatching Triage neshta

Result

Malware family:

neshta

Alert

Create hunting rule

Score:

  10/10

Tags:

family:neshta discovery persistence spyware stealer

Link:

https://tria.ge/reports/251206-qmbxmset7d/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Adds Run key to start application

Checks computer location settings

Drops startup file

Executes dropped EXE

Modifies system executable filetype association

Reads user/profile data of web browsers

Adds policy Run key to start application

Neshta

Neshta family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI NJRat

Threat name:

NJRat

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

vbs 973bbcc50c5ecb3be327c08a44141531837c9665fd697a0ab35a0777ece62cda

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3727360/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/42732/