MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03a424fc93d692901bc1ca02b532934101c5448d093c9b0d74fa927f14304bd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03a424fc93d692901bc1ca02b532934101c5448d093c9b0d74fa927f14304bd3
SHA3-384 hash: d53242dfdf29f62024f822c8188917867fbb02dc9182b0725ca52599e192b3e083667a2d42eb669835791a6a53b823f7
SHA1 hash: e266e0608582ad6ced723d24a99f596d04a397cb
MD5 hash: 0caac68967a740763027d0f848386f7b
humanhash: east-five-pennsylvania-three
File name:03a424fc93d692901bc1ca02b532934101c5448d093c9b0d74fa927f14304bd3
Download: download sample
Signature njrat
Create hunting rule
File size:1'059'328 bytes
First seen:2020-06-17 09:03:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:icbfCBQokSW0j7VDI+3C2H6qUqYeYY1jLMex5pvQSWqFacj54sN:icbWQokS/i+3RxUqZYY1LMeRbWqx4s
Threatray 146 similar samples on MalwareBazaar
TLSH 6C35125AB68EBE06E26E063258F1D2250CF2BE3F1541C57674A437796B776CCCC0268E
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19275/
Detection(s):
Win.Packed.Hpbladabi-6860330-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2015-11-16 00:44:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aoscj7et22jjag6bziblkmutiea4krenbe6jwdlu7kjh6fbqjpjq._file
Verdict:
unknown
Similar samples:
13eccac589ff4426a37b8dfc64823815440f411c6f2bd59f049a59e5afad22e6
njrat
19f763b4199e2bee6affbd7a92bcd07f0234a3351a82a3df0e25ed48af1dc724
njrat
3e30d9e15ee915170a4823f8a603376b1c77de63199c635bceaa086072358a8f
njrat
44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
njrat
9edea7d68a48e54ec499302700e64a41a2cb38dab5d5d51c30c1ff2e40c393cf
njrat
ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc
njrat
d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
njrat
d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
njrat
da0c0089713cfd5b47f425f23c23f9a9d82e62000873747dce1a73220319f93e
njrat
fb3ca1866e216ffad74344e564be2f8aacabeb2c4616113d9fddf11561096bb6
njrat
+ 136 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200624-1ne49n6ef2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19275/

Comments