MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb3c47dd39270fe9f683f3c4f12d07cd668039fcbc15a175970a57ff363f7026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb3c47dd39270fe9f683f3c4f12d07cd668039fcbc15a175970a57ff363f7026
SHA3-384 hash: 9d680a1d9b84871f24ed9156fbd703b35d1eac05d4c779471d6fa9ccda5ad9c529007eececd2c823b717209e322c53ce
SHA1 hash: 584afe802bb5167cb57d4fb4924d3bb3818bd328
MD5 hash: c07d7a3acbc71929c81811a3249c0ca4
humanhash: orange-glucose-hot-jig
File name:fb3c47dd39270fe9f683f3c4f12d07cd668039fcbc15a175970a57ff363f7026
Download: download sample
Signature njrat
Create hunting rule
File size:116'736 bytes
First seen:2020-06-29 07:44:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:r+18OqB3kkNQe9pqEP6rw7BUknhPnCu2PvcRd12Rco41PpygYYKGaHi8:xOqBFZ6MfV2AccomhygYVGu
Threatray 113 similar samples on MalwareBazaar
TLSH F1B362766081D7A3C2111CFB8BA3A3C8DEA5A176A9C25F368FB8233419F135865F355C
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15884/
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb3c47dd39270fe9f683f3c4f12d07cd668039fcbc15a175970a57ff363f7026/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 02:15:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7m6epxjze4h6t5ud6pcpclihzvtiaop4xqk2c5mxbjl76nr7oata._file
Verdict:
unknown
Similar samples:
22f131686ed7410f8a34d6762fc7cb2f7d386760b928b25be91eaaf05d92f7f6
njrat
2a46e0846fb5b909da9df065c96a2c482075dac2d57bc5bc02d70954e9c7e7da
njrat
48c48f726a9586a076799e229ff5b938e3e4512fa6338963266528f8fa062656
njrat
6952d61c1b90bbe292626eddde290f0649ff02beca59738bf0912f6e1491538e
njrat
74bd2252ee4d11e9fc386239cacf42ca0611a7d0f51106658689039a7b83c551
njrat
9970470d471813416b034f776f44ce2d8beda6ff4fa38193bb18b2c450e24326
njrat
9d8cdbdc6213aa85dc5095947dc22c9c7c57c3743dde10817b2b39183d9afda0
njrat
c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f
njrat
e30821af035b182de6dc8b54d9506383cd5a5713c4448faa4c842763371063b2
njrat
f1276162c44adfda7e0a2c65fa73515a29b0c56c4f0012273ac80114c01306f6
njrat
+ 103 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200629-3ckzjkeqgn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15884/

Comments