MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 668ec5b9759f0349cc79113c4d2bb62ebf2239de79532f97248b242df8608a3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 668ec5b9759f0349cc79113c4d2bb62ebf2239de79532f97248b242df8608a3c
SHA3-384 hash: 059f68b5f3b67b984c6c17181121925a8a2985a500afcc75c9440318f45853d97974064bf67bca8bc5137b8e14e5fbe6
SHA1 hash: 1c45efc86cd4412b2fbe255af176acc622ddcd4f
MD5 hash: 9a138e44871c402fa2d3067dc160a4e8
humanhash: don-iowa-uranus-mexico
File name:668ec5b9759f0349cc79113c4d2bb62ebf2239de79532f97248b242df8608a3c
Download: download sample
Signature njrat
Create hunting rule
File size:1'422'336 bytes
First seen:2020-06-10 07:36:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fa6c1edf009fc0ee0d8a61bd14de7800 (1 x njrat)
ssdeep 24576:z6URtlKgWJAdR512ytwSPnrW5tLs2CTNy5q/je/FsASVA98GVQaNS5HFyOa:eKXKx+v512yOSPnrIoTN3realAWwQaUc
Threatray 22 similar samples on MalwareBazaar
TLSH 506523B2502614B2EF0DD67E27193B38B57CDA1082A6752552D2AFF7B00387E41EF90B
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 21:24:00 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2hmlolvt4buttdzce6e2k5wf27seoo6pfjs7fzermsc36dari6a._file
Verdict:
malicious
Similar samples:
01b44b9b3c3a6d3fc638b9a64e25ed866379539dddd9590290f71175352a9b23
njrat
118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1
njrat
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
njrat
77b2ce43a1a7363d6c90b9b11fc05220511a868f4f8ca72cd6cbe3219f79fbdd
njrat
956a4834f9fd06b41877a81e7edb083994d53daae9739fcfb8d4f82203105414
njrat
9dfc0d127c1129cd943b1c6ea494a01b40b6b29656db9a44f3dc3231db127a0e
njrat
9fdf001f730abe9e97454ce266d79326fb6e7c02fa6f3c16a7bbf5485ef674c4
njrat
a6f6ee6214681cc7c2fcd82af2b0d8362600624e35a6d027b70787561b1f67d9
njrat
b571436ef8d4284f5dabee122973c8710965a31de19f80f7a8a62cb8cea8f1d6
njrat
b5961f407c0afef04c9406ba17cbae3fe4cc575b47e50081abbda0d96f9c0f18
njrat
+ 12 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-qnyt7qqpgj/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Modifies registry class
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments