MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 11 File information Comments

SHA256 hash:	fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c
SHA3-384 hash:	83fdb21e376e77904d2db6c91ce087bf7a771e2053d5e58e5b7106c7a549497947f302d338c468f87551063cf8b0cb41
SHA1 hash:	d19bc1d857c6ac0fd5143d35f11962c8c1bb2ddb
MD5 hash:	d392a74abf4bbae59a987618978a7d1e
humanhash:	equal-angel-pip-harry
File name:	incrustado.vbs
Download:	download sample
Signature	njrat Create hunting rule
File size:	247'540 bytes
First seen:	2025-08-15 12:25:10 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:7sssQsssQsssAsssdsssdsssdsss4sssdsssdsssdsssRsssdsssdsssdsss7ssW:B
Threatray	987 similar samples on MalwareBazaar
TLSH	T1DF345D0F52BC3206259A41AA6BDD480B63637F5577B4A643EBCF4C0AA47EC721F0875B
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	unknown
Reporter	abuse_ch
Tags:	NjRAT RAT vbs

abuse_ch

njrat C2:
46.246.14.3:5552

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
46.246.14.3:5552	https://threatfox.abuse.ch/ioc/1569003/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/21529/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689f274548c64d68735c86e9

Tags:

bladabindi njrat

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 base64 evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/689f2746a4bdac9f5b986e64/reports/f426924b-46bd-43a6-a4c1-76e4c428b9df/overview

Verdict:

Suspicious

Labled as:

HEUR_Trojan_Script_Generic

Link:

https://www.hybrid-analysis.com/sample/fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c

Result

Threat name:

Njrat

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1757809

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Encrypted powershell cmdline option found

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c

Verdict:

Malware

YARA:

2 match(es)

Tags:

DeObfuscated PowerShell VBScript WScript.Shell

Link:

https://app.malva.re/file/d392a74abf4bbae59a987618978a7d1e

Detection:

njrat

Link:

https://mwdb.cert.pl/sample/fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c/

Verdict:

Malicious

Threat:

Trojan.MSIL.Bladabindi

Link:

https://tip.neiki.dev/file/fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c

Threat name:

Script-WScript.Trojan.GuLoader

Status:

Malicious

First seen:

2025-08-15 12:25:39 UTC

File Type:

Text (VBS)

AV detection:

6 of 23 (26.09%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=73jgaudvbdr4errsqahoftjz5hcadt3pqtv6grtzpgcxz3bn72oa._file

Verdict:

malicious

Label(s):

njrat

Result

Malware family:

njrat

Score:

10/10

Tags:

family:njrat botnet:nyan cat discovery execution trojan

Link:

https://tria.ge/reports/250815-plxmaawqz2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

Njrat family

njRAT/Bladabindi

Malware Config

C2 Extraction:

romanovas.duckdns.org:5552

Dropper Extraction:

https://dpaste.org/NLPNG/raw

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fed260507508e3c24632800ee2cd39e9c401cf6f84ebe3467979857cec2dfe9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ByteCode_MSIL_Backdoor_NjRAT Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects NjRAT backdoor.

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	njrat_v1 Create hunting rule
Author:	RandomMalware

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)