MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 031b235aecbb9dd278dd748679c3103920a23a7f7eb5938b328346a7e45eece7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 031b235aecbb9dd278dd748679c3103920a23a7f7eb5938b328346a7e45eece7
SHA3-384 hash: 4f47466beb87297b3fac6456f3fdbe405cae117dc1a7a7bd76507aa741787c202aa75e0c5c872e252c3a2ce1e8f7579c
SHA1 hash: fee9529dc9cc3a5ba208eb35f321794065bcdd01
MD5 hash: bfc57dbf144c8414b0187d890e5ae560
humanhash: lima-shade-berlin-triple
File name:031b235aecbb9dd278dd748679c3103920a23a7f7eb5938b328346a7e45eece7
Download: download sample
Signature njrat
Create hunting rule
File size:2'205'184 bytes
First seen:2020-06-17 08:51:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bc70c4fa605f17c85050b7c7b6d42e44 (15 x njrat, 12 x RedLineStealer, 10 x AgentTesla)
ssdeep 49152:dQXJghlsCZFUpQb13foKsfPLvBiIsmuMnUQcuTqLQdLpKRHSYt9:dhOCZyyholnVDsm1UQcuTqQK
Threatray 72 similar samples on MalwareBazaar
TLSH 8FA53307A3F44652FCFB5BF12AFA5283043F7C61AE38A26F018417DA4D72591A97472B
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19232/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 03:10:16 UTC
File Type:
PE (Exe)
Extracted files:
316
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=amnsgwxmxoo5e6g5osdhtqyqheqkeot7p22zhczsqndkpzc65ttq._file
Verdict:
unknown
Similar samples:
2a46e0846fb5b909da9df065c96a2c482075dac2d57bc5bc02d70954e9c7e7da
njrat
3027dc21e325fddbc9e6cd21b0491f3270190f219776de4971e510c4490d3c25
njrat
35628fc8f90a6db8f30ab2f3ec4b743190381958f72c75d1a8ae828d6afb6370
njrat
380f06e9a34d63f3b41e94cdb6781254e7582c811adaaf48855d4e945e8f96b0
njrat
686bf5243c5d71d36ce6c9b870cad9316aa1218154614fdcd091d7bb8573ca2c
njrat
6952d61c1b90bbe292626eddde290f0649ff02beca59738bf0912f6e1491538e
njrat
927f575e760758781d405edb7a7a16bd4a8069babb55a4bde1103f235fe0b602
njrat
a9297e27075d755670954bcffb05bc3dd60fde115a342c93a6e76ac9ff6b9494
njrat
c1dc52285b9b9c38bdcfd347559f64b0de7394a8f66714e3b9148216fc91a411
njrat
c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f
njrat
+ 62 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200624-11k5nhngre/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19232/

Comments