🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
SHA3-384 hash: 985c947702fa248bd4a7930a3a066cc909251ce1e622d5d17f6f629b9e862d3323a4c3c3ed1bad03e53130bd94787fd0
SHA1 hash: 483c3ed2cb002595347671dd54f976d805df955e
MD5 hash: f7834842d0b4311abbe73e7e5fbdc646
humanhash: arkansas-kilo-thirteen-green
File name:AVIODIRECTPN_Desc__QtyDetails.js
Download: download sample
Signature njrat
Create hunting rule
File size:76'556 bytes
First seen:2025-10-29 19:20:56 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:bI/478CnXARDkTuxWuxWuxWuxWuxWuVuxWuxWuxWuxWuxWuxWt:bIQ1Tfffff6fffffft
Threatray 65 similar samples on MalwareBazaar
TLSH T1CA73161223AF821876F6138E856F11750B7B7E4A193D816D12CCB64A8FF39049C9A7F7
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter smica83
Tags:js NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
226
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26866.JsHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.JS.Exec-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690261729942f1282eca37e6
Tags:
xtreme shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 powershell repaired
Link:
https://www.filescan.io/uploads/690272c6de25fddba05c309f/reports/bc0bf4d8-383a-4086-94b9-b147a3f10f63/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
Verdict:
Malicious
File Type:
js
First seen:
2025-10-29T19:16:00Z UTC
Last seen:
2025-10-29T19:35:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154/results?tab=lookup
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1804423
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Contains functionality to log keystrokes (.Net Source)
Contains functionality to spread to USB devices (.Net source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Disables zone checking for all users
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Self deletion via cmd or bat file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1804423 Sample: AVIODIRECTPN_Desc__QtyDetails.js Startdate: 29/10/2025 Architecture: WINDOWS Score: 100 148 textbin.net 2->148 150 lepritz29.bumbleshrimp.com 2->150 152 009423af623840eb89fb1759543879431.1851946.meusitehostgator.com.br 2->152 174 Suricata IDS alerts for network traffic 2->174 176 Malicious sample detected (through community Yara rule) 2->176 178 Antivirus detection for URL or domain 2->178 182 16 other signatures 2->182 13 wscript.exe 1 1 2->13         started        16 cmd.exe 2->16         started        18 cmd.exe 2->18         started        20 5 other processes 2->20 signatures3 180 Connects to a pastebin service (likely for C&C) 148->180 process4 signatures5 228 JScript performs obfuscated calls to suspicious functions 13->228 230 Suspicious powershell command line found 13->230 232 Wscript starts Powershell (via cmd or directly) 13->232 234 4 other signatures 13->234 22 powershell.exe 17 13->22         started        26 PING.EXE 1 13->26         started        28 powershell.exe 16->28         started        30 conhost.exe 16->30         started        32 powershell.exe 18->32         started        34 conhost.exe 18->34         started        36 powershell.exe 20->36         started        38 powershell.exe 20->38         started        40 4 other processes 20->40 process6 file7 144 C:\Users\Public\teste.ps1, Unicode 22->144 dropped 206 Self deletion via cmd or bat file 22->206 208 Adds a directory exclusion to Windows Defender 22->208 210 Found suspicious powershell code related to unpacking or dynamic code loading 22->210 42 powershell.exe 14 18 22->42         started        46 conhost.exe 22->46         started        212 Writes to foreign memory regions 28->212 214 Injects a PE file into a foreign processes 28->214 48 powershell.exe 28->48         started        55 3 other processes 28->55 51 powershell.exe 32->51         started        57 3 other processes 32->57 53 powershell.exe 36->53         started        59 4 other processes 36->59 61 5 other processes 38->61 signatures8 process9 dnsIp10 158 009423af623840eb89fb1759543879431.1851946.meusitehostgator.com.br 172.64.145.200, 443, 49682, 49686 CLOUDFLARENETUS United States 42->158 146 C:\Users\Public\wnvrf_01.ps1, Unicode 42->146 dropped 63 powershell.exe 17 42->63         started        162 Writes to foreign memory regions 48->162 164 Injects a PE file into a foreign processes 48->164 68 powershell.exe 48->68         started        70 InstallUtil.exe 48->70         started        72 InstallUtil.exe 48->72         started        74 powershell.exe 48->74         started        76 powershell.exe 51->76         started        80 3 other processes 51->80 78 powershell.exe 53->78         started        82 2 other processes 53->82 file11 signatures12 process13 dnsIp14 160 textbin.net 104.21.42.211, 443, 49685 CLOUDFLARENETUS United States 63->160 142 C:\Users\user\AppData\LocalLow\...\qevlk.ps1, Unicode 63->142 dropped 166 Self deletion via cmd or bat file 63->166 168 Adds a directory exclusion to Windows Defender 63->168 84 powershell.exe 63->84         started        87 cmd.exe 1 63->87         started        89 powershell.exe 63->89         started        95 7 other processes 63->95 170 Writes to foreign memory regions 68->170 172 Injects a PE file into a foreign processes 68->172 91 powershell.exe 68->91         started        97 3 other processes 68->97 93 powershell.exe 76->93         started        99 3 other processes 76->99 101 2 other processes 78->101 file15 signatures16 process17 signatures18 184 Writes to foreign memory regions 84->184 186 Injects a PE file into a foreign processes 84->186 103 InstallUtil.exe 84->103         started        107 powershell.exe 84->107         started        188 Suspicious powershell command line found 87->188 190 Wscript starts Powershell (via cmd or directly) 87->190 192 Uses ping.exe to sleep 87->192 194 Uses ping.exe to check the status of other devices and networks 87->194 109 PING.EXE 1 87->109         started        196 Creates autostart registry keys with suspicious values (likely registry only malware) 89->196 198 Creates multiple autostart registry keys 89->198 111 powershell.exe 91->111         started        119 3 other processes 91->119 121 2 other processes 93->121 200 Loading BitLocker PowerShell Module 95->200 113 PING.EXE 1 95->113         started        115 PING.EXE 1 95->115         started        117 WmiPrvSE.exe 95->117         started        process19 dnsIp20 154 lepritz29.bumbleshrimp.com 196.251.116.124, 49691, 5765 xneeloZA Seychelles 103->154 216 Disables zone checking for all users 103->216 218 Creates autostart registry keys with suspicious names 103->218 220 Creates multiple autostart registry keys 103->220 226 3 other signatures 103->226 123 netsh.exe 103->123         started        125 powershell.exe 107->125         started        127 powershell.exe 107->127         started        129 powershell.exe 107->129         started        131 powershell.exe 107->131         started        156 127.0.0.1 unknown unknown 109->156 222 Writes to foreign memory regions 111->222 224 Injects a PE file into a foreign processes 111->224 133 powershell.exe 111->133         started        136 InstallUtil.exe 111->136         started        138 powershell.exe 111->138         started        signatures21 process22 signatures23 140 conhost.exe 123->140         started        202 Writes to foreign memory regions 133->202 204 Injects a PE file into a foreign processes 133->204 process24
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
Verdict:
Malware
YARA:
1 match(es)
Tags:
Base64 Block Contains Base64 Block DeObfuscated PowerShell
Link:
https://app.malva.re/file/f7834842d0b4311abbe73e7e5fbdc646
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154/
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Link:
https://tip.neiki.dev/file/fbeaaff51575496bb602960afd1903be389c7f405a249ea5e630ae8d53a50154
Threat name:
Script-JS.Backdoor.njRAT
Create hunting rule
Status:
Suspicious
First seen:
2025-10-29 16:04:31 UTC
File Type:
Text (JavaScript)
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pvk75ivovewxnqcsyfp2gidxy4jy72alisj5jpggcxi2u5fafka._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
00b11363c9cd9f5e944789c5c8c8f190cb8952e572fcad351c10a0ffe4809765
njrat
81553f2de290ddf3a7dd40e0a8877781c8ac8cfb0fe5d0159a2b3ce3eda4c6f6
njrat
b899673b927792615d4583738de9f4f07176d74c7591b38d58183c206dc0f127
njrat
d4d365c9e686e825943c53df122f109df1485a549a9c12e9b8f0346e9a359071
njrat
e7970266d974e4653952106e56856dbf4fa04f1ec03001c77b44c4648b1c9386
njrat
error
njrat
f7f52f6bbffa02fffcea30d5806050b7702a9a78dcbeae83e28c45d81aa1c4c4
njrat
fb56cdc76786090a820af3235a4a448a0d113986690bc77cad716d6c940c455a
njrat
ff25936286221005b27254e316c0622a3e828791a2988c163613475263127c0f
njrat
+ 55 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/251029-ym7nbatjes/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Indicator Removal: File Deletion
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Modifies Windows Firewall
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fbeaaff51575/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments