🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 15


Intelligence 15 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120
SHA3-384 hash: bb6ec6a70dabcf96f2c83886d1e9967621e8dfbda1eca6e305700e58f1e49ce3b8adfe9a713a4f682460ebe32cb6eea4
SHA1 hash: 3a7dc3b6a891bdb2f9cc7a33a19ebc49d897ff4e
MD5 hash: 053d760fd3acad06ce0bff5ab5126ba6
humanhash: fillet-winter-carbon-item
File name:NERESTPC.exe
Download: download sample
Signature njrat
Create hunting rule
File size:1'255'424 bytes
First seen:2025-10-09 20:14:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'491 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 12288:+AW10rmu1Dg1l1RhL7RlYwbXrUvLJQTcRkeqd5W9ZMltSMmfPiFimnORoMbrklyV:Le0JDgPZLIEXrE
TLSH T14F45149D766072DFC85BD472DEA81C64EB6074BB931F9203902716EDAA0D997CF180F2
TrID 58.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
13.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.4% (.EXE) Win64 Executable (generic) (10522/11/4)
5.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter burger
Tags:CelestialRAT exe NjRAT RAT stealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
267
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NERESTPC.exe
Verdict:
Malicious activity
Analysis date:
2025-10-09 20:14:07 UTC
Tags:
stealer telegram exfiltration ims-api generic celestialrat rat confuser
Link:
https://app.any.run/tasks/27e19bad-cc66-4570-8607-8f70c7d2ec0c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31955/
Detection(s):
PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e817908b7b147cc4b653a7
Tags:
emotet lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Creating a file in the %temp% directory
Running batch commands
Connection attempt
DNS request
Launching a process
Sending an HTTP GET request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 confuser confuserex njrat njrat obfuscated obfuscated packed phoenix privilege rat reconnaissance
Link:
https://www.filescan.io/uploads/68e817a14f3013c55e48c2b0/reports/93f46ace-3026-4627-a5c3-79c36f58ef7d/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-09T06:53:00Z UTC
Last seen:
2025-10-09T18:30:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-PSW.MSIL.Coins.gen Trojan-PSW.Win32.Coins.sb
Link:
https://opentip.kaspersky.com/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dd479357-6cee-4fd5-8399-9b8f2c2d54b3
Result
Threat name:
Celestial Rat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1792407
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential evasive VBS script found (sleep loop)
Potential malicious VBS script found (has network functionality)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AntiVM3
Yara detected Celestial Rat
Yara detected Telegram RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1792407 Sample: NERESTPC.exe Startdate: 09/10/2025 Architecture: WINDOWS Score: 100 75 ipv4.geojs.io 2->75 77 c3lestial.fun 2->77 91 Found malware configuration 2->91 93 Multi AV Scanner detection for submitted file 2->93 95 Yara detected Celestial Rat 2->95 97 9 other signatures 2->97 10 NERESTPC.exe 1 7 2->10         started        14 Celestial.exe 2->14         started        signatures3 process4 file5 63 C:\Users\user\AppData\...\Celestial.exe, PE32 10->63 dropped 65 C:\Users\...\Celestial.exe:Zone.Identifier, ASCII 10->65 dropped 67 C:\Users\user\AppData\...67ERESTPC.exe.log, CSV 10->67 dropped 101 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 10->101 103 Adds a directory exclusion to Windows Defender 10->103 105 Queries memory information (via WMI often done to detect virtual machines) 10->105 16 Celestial.exe 15 6 10->16         started        21 powershell.exe 23 10->21         started        signatures6 process7 dnsIp8 69 144.31.188.134, 3333, 49689, 49692 UAMS-ASNUS United States 16->69 71 ipv4.geojs.io 5.161.104.165, 443, 49690 HETZNER-ASDE Germany 16->71 73 c3lestial.fun 172.67.142.153, 443, 49691 CLOUDFLARENETUS United States 16->73 59 C:\Users\user\AppData\Local\...\watchdog.vbs, ASCII 16->59 dropped 61 C:\Users\user\AppData\Local\...\watchdog.bat, DOS 16->61 dropped 79 Multi AV Scanner detection for dropped file 16->79 81 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->81 83 Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines) 16->83 87 6 other signatures 16->87 23 cmd.exe 3 2 16->23         started        25 powershell.exe 16->25         started        28 cmd.exe 16->28         started        32 2 other processes 16->32 85 Loading BitLocker PowerShell Module 21->85 30 conhost.exe 21->30         started        file9 signatures10 process11 signatures12 34 wscript.exe 23->34         started        37 conhost.exe 23->37         started        39 chcp.com 23->39         started        99 Loading BitLocker PowerShell Module 25->99 41 conhost.exe 25->41         started        43 wscript.exe 28->43         started        45 conhost.exe 28->45         started        47 chcp.com 28->47         started        49 wscript.exe 32->49         started        51 4 other processes 32->51 process13 signatures14 89 Windows Scripting host queries suspicious COM object (likely to drop second stage) 34->89 53 Celestial.exe 34->53         started        55 Celestial.exe 43->55         started        57 Celestial.exe 49->57         started        process15
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120
Verdict:
njRat
YARA:
16 match(es)
Tags:
.Net Executable Managed .NET njRat PE (Portable Executable) PE File Layout RAT SOS: 0.95 Win 32 Exe x86
Link:
https://app.malva.re/file/053d760fd3acad06ce0bff5ab5126ba6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Coins
Link:
https://tip.neiki.dev/file/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-10-09 11:33:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pw7y2jltku475lnbuh4hfqogyemmr2sdsjipto7hkydwcfpqeqa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/251009-yz5z9ayyh1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c00338ca-e1c8-4d7c-b33c-e90800ff1cd0
Unpacked files
SH256 hash:
ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120
MD5 hash:
053d760fd3acad06ce0bff5ab5126ba6
SHA1 hash:
3a7dc3b6a891bdb2f9cc7a33a19ebc49d897ff4e
Link:
https://www.unpac.me/results/e9e39c85-7548-44ff-b53b-c793b6d9b3c6/
SH256 hash:
a22b019d4054c3e30eb80c7073612c059f7d896621b82c2ea48083c036d79185
MD5 hash:
d8a120405eacaebae1c29ccc287467cb
SHA1 hash:
fb9de0c589ac39dc13457cda90010a7d25ff5981
Link:
https://www.unpac.me/results/e9e39c85-7548-44ff-b53b-c793b6d9b3c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_Generic_MassHunt_Webshells_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic multi-language webshell mass-hunt rule (PHP/ASP(X)/JSP/Python/Perl/Node) - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31955/

Comments