MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 13


Intelligence 13 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
SHA3-384 hash: d751a86ce5d658a3b009d16a63d7608d4f6bd9f0d3e518c1b01ca69bcbfb8fa1b22b34e36d948bc4f86c2fa97208836f
SHA1 hash: 901a7e8d56814d032e2e83d6e61d5d899e221e48
MD5 hash: 1146d3978a908b51d20b323fd260495a
humanhash: shade-eight-london-alaska
File name:Bootstrapper.exe
Download: download sample
Signature njrat
Create hunting rule
File size:2'945'024 bytes
First seen:2026-04-15 11:44:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'880 x AgentTesla, 19'800 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 49152:TgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4k6WY:TgVUuHjkDGjzqpgmwQ1GuRxzew
Threatray 32 similar samples on MalwareBazaar
TLSH T127D5121C33FACB18F2AF4BB4A87185664771FD178D62D76C589139AE04B6F48BA10B13
TrID 49.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
29.3% (.EXE) InstallShield setup (43053/19/16)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win64 Executable (generic) (6522/11/2)
3.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter burger
Tags:exe NjRAT ratonrat

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Bootstrapper.exe
Verdict:
Malicious activity
Analysis date:
2026-04-15 11:42:14 UTC
Tags:
raton rat
Link:
https://app.any.run/tasks/a807cb85-ccc6-4196-9023-76ca538f90fc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61736/
Detection(s):
Win.Packed.Adwarex-9851111-0
Create hunting rule

Win.Packed.Bulz-9891112-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69df7a20f68adfe1003a093f
Tags:
vmdetect autorun emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Creating a file
Launching a process
Creating a process from a recently created file
Sending a custom TCP request
Loading a suspicious library
Creating a window
Connection attempt
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
MSIL.PasswordStealerA.Generic
Link:
https://www.hybrid-analysis.com/sample/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-15T08:45:00Z UTC
Last seen:
2026-04-15T19:52:00Z UTC
Hits:
~10
Detections:
Trojan.MSIL.Agent.sb Trojan-PSW.MSIL.Stealer.sb Trojan-PSW.MSIL.Agent.sb HEUR:Trojan.Win32.Generic Backdoor.MSIL.Crysan.d VHO:Trojan.MSIL.Inject.gen
Link:
https://opentip.kaspersky.com/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1273ebbf-a37d-432f-972b-1a5759caca81
Result
Threat name:
RatonRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1898672
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to capture screen (.Net source)
Contains functionality to disable the Task Manager (.Net Source)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Self deletion via cmd or bat file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Raton RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1898672 Sample: Bootstrapper.exe Startdate: 15/04/2026 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected Raton RAT 2->44 46 10 other signatures 2->46 8 Bootstrapper.exe 30 2->8         started        12 Bootstrapper.exe 2 2->12         started        process3 file4 30 C:\Users\user\AppData\...\Bootstrapper.exe, PE32 8->30 dropped 32 cleanup_CTzCOxSEdJ...ffCrcwMToGWSjNv.bat, DOS 8->32 dropped 34 C:\Users\...\Bootstrapper.exe:Zone.Identifier, ASCII 8->34 dropped 36 22 other files (1 malicious) 8->36 dropped 54 Self deletion via cmd or bat file 8->54 14 cmd.exe 1 8->14         started        16 conhost.exe 8->16         started        signatures5 process6 process7 18 Bootstrapper.exe 2 14->18         started        22 conhost.exe 14->22         started        24 timeout.exe 1 14->24         started        26 2 other processes 14->26 dnsIp8 38 127.0.0.1 unknown unknown 18->38 48 Multi AV Scanner detection for dropped file 18->48 50 Uses schtasks.exe or at.exe to add and modify task schedules 18->50 52 Potential Privilege Escalation using Task Scheduler highest RunLevel 18->52 28 schtasks.exe 1 18->28         started        signatures9 process10
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1/
Verdict:
Malicious
Threat:
Backdoor.MSIL.Crysan
Link:
https://tip.neiki.dev/file/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2026-04-15 11:44:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zygqrpsrmn3plxwmhp3nrfypusj4sjn4ae5ardbkj24o3h47ypyq._file
Verdict:
malicious
Label(s):
ratonrat
Create hunting rule
Similar samples:
3dc4e6bae0421dbc3bd7c526e0c42e79a396465b2ef9c2c2cac0d59cc1750054
njrat
65e847a202c09cc5867132c9f95163752f226112e7b18928bc3cd3d0d82d98fd
njrat
a69a3e149d3953527bf129af100268c7cd0b2b954b453024ed360efe8b79e26b
njrat
ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
njrat
error
njrat
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion execution persistence
Link:
https://tria.ge/reports/260415-nwmdmacz6l/
Behaviour
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Unpacked files
SH256 hash:
ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1
MD5 hash:
1146d3978a908b51d20b323fd260495a
SHA1 hash:
901a7e8d56814d032e2e83d6e61d5d899e221e48
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
d8c7b21aff766ef7e94ba5049cdfc1d8603ac1c125f408e01a89e4596f81c897
MD5 hash:
19b2654ee78512d22ff71aa74bb6b2d6
SHA1 hash:
07dfee529b058236c3d1041fe4f8b0dca71ffcef
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
c717dfba233e08b91c0d9941f2e26ecd45f959d4a14a75909a1dd9838cde4ae8
MD5 hash:
f6e218dddcb66cd72e1c719dfe3a8da0
SHA1 hash:
abddf32d13b0749327243999012ad6274a51f106
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
3e60e50ff6657a392edd57a2a71c06e59df43c8d27f73e4e0604c057aa10d971
MD5 hash:
17382123f96442304c0a87cd4e725560
SHA1 hash:
05c7dabf47a4cc98e8e0e7e831676ba047cd08e3
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
b58a822e5bdfca93ec38bc481bc00a5ad38cfe4103526421ab28d346791a2a09
MD5 hash:
86c5cf90b1d2847b7df60ce79c2145d6
SHA1 hash:
084c6ec381d1125dc02cee5b97cf7f468f48976a
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
6bf97a2837c894f10012c2889c064ed07b698581296839035f663dfd82bcd3b4
MD5 hash:
41741d072f1db7f9bd854f5ae3d1c5dc
SHA1 hash:
0ee05639220264482a0fd8133371c2cb7820f4b6
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 hash:
f6940019dad6c782bcb645c2f7d52db5
SHA1 hash:
1bbe492757bf99840d923fdd44c6a3f34b336cf7
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
MD5 hash:
4b874a3043d5e3c133f4c35863159638
SHA1 hash:
3a7d21700497d81c41193544b7ea913032d0aa82
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 hash:
e90ac3063409ef6876e26422dc61d0eb
SHA1 hash:
3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
2f1725d05b424f154f931a3c96a14318d48da2297c12fb33b384786a9a70f717
MD5 hash:
f6aa556b07dcfb7d3105e1eab11f8162
SHA1 hash:
44a66ea7c6d0e456006515226a03a31862f5b52a
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 hash:
f8d5274e3368aa40cc0fd5798d19c783
SHA1 hash:
87f87d8c2b468fb87d82c3f5a849936c08d7a67c
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 hash:
c1b78af3d6402be8f259dbbe9250e7fb
SHA1 hash:
98e2c38597c50390852801d46ff342889c7351ae
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
fae06a2e756e6332df98f16991a0183bd61fbe83a015d83d4518461c120977a7
MD5 hash:
1494a1cde33c013757b4f397a727d372
SHA1 hash:
c384672f7c7946637f9684e36b406a28f5f8f7ed
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
5516f7b78eb7c391e50872a1cb5fa91e58daf02298478deef8b1269576088ec2
MD5 hash:
bb94fc038231aaa7a84281de4c188259
SHA1 hash:
d24570af262fc7614e52cd1b15a758dbb4356eaa
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 hash:
115137414b41a26d6e73738cd94c036c
SHA1 hash:
e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
SH256 hash:
d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
MD5 hash:
0bfef61b203054f6fbf08419ffe3f018
SHA1 hash:
ed9d0418507630996eb2c473ec5daf11d185c2c6
Link:
https://www.unpac.me/results/222201ca-9a88-484e-97fc-469b492520bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce0d08be516376f5decc3bf6d8970fa493c925bc013a088c2a4eb8ed9f9fc3f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Qemu_Description
Create hunting rule
Rule name:Check_Qemu_DeviceMap
Create hunting rule
Rule name:Check_VBox_Description
Create hunting rule
Rule name:Check_VBox_DeviceMap
Create hunting rule
Rule name:Check_VBox_Guest_Additions
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:Check_VMWare_DeviceMap
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61736/

Comments