MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7
SHA3-384 hash: 4ee05afce10fed596107a0ced27efb52ced8a0f8451bda1c21840dfe6dfc2af08c263de7908fef921616224d280167bb
SHA1 hash: 0378936325dd0a19ac2547ad462017db60d9d315
MD5 hash: 8e0342b0a50e046c2b22f6d9548024eb
humanhash: early-aspen-sodium-muppet
File name:04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Download: download sample
Signature njrat
Create hunting rule
File size:93'184 bytes
First seen:2021-09-16 00:35:51 UTC
Last seen:2021-09-16 02:08:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'648 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 1536:N48CiQGC3ZE83GhZ2wr1j5NhhqQdUd7QzFd3yZz1I:N4BdGCK83GhZ2w5Q7kFoZz1I
Threatray 170 similar samples on MalwareBazaar
TLSH T1A0931C2539EE6029F1B3AF716FF476D6DA6FFFA22602985E108003064532942FDD1A7D
dhash icon 414555c0d4d44503 (15 x njrat, 14 x BlackNET, 8 x Lucifer)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
192.169.69.25:1979

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.169.69.25:1979 https://threatfox.abuse.ch/ioc/222461/

Intelligence

File Origin
# of uploads :
2
# of downloads :
465
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Verdict:
Malicious activity
Analysis date:
2021-09-16 00:37:10 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/1ff8f22a-dec3-4e21-96df-b6dfc13e3de1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/188288/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader35.54661.30566.28881.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/61751e009a5a1e91c5d203f9/reports/1cda7922-cf8f-457f-94bb-7543bb874120/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/94bd6ce8-e034-4dba-8c83-469e62944163
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/851762
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2018-10-23 01:13:13 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atq2crrz7h6qsa7sd3oztmok3sjgpmfmf5acqy6w5m5mytkivt3q._file
Verdict:
malicious
Similar samples:
10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
njrat
14eb1e82e99353e4e4fb35444b82e3af528ea1193e921b14f8ebdba6e457f0ef
njrat
4500ccf59d93041b081e3ba5e60be483ab84f9e08f1f00045f6c6a0138e8b787
njrat
454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c
njrat
4e7678bfa4bd0656d406b6452f501cb54fcc6ddc7c9debde66fda39415c2222f
njrat
c2a8b81591a60318a09bcfd8d403cd7ab45018d40457e7ce7a86d2b1a4d6ac27
njrat
d6b1f8c5ddef7568c1985b99db389b4671d6cf3a4004866d93620553da133992
njrat
dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa
njrat
e73a75a27e10ebb5efaa129b0d8163ea8e2d1ba544d297ba7259dcf6019b4ca3
njrat
e929f1289f145ca3b34a7970ad5ee02c90851d95ae3142ee0e09a76a4ac7d234
njrat
+ 160 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:hacked evasion suricata trojan
Link:
https://tria.ge/reports/210916-axxzvsegdj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Windows Firewall
njRAT/Bladabindi
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Malware Config
C2 Extraction:
kanichnadia.duckdns.org:1979
Unpacked files
SH256 hash:
03cd1d30276ee8a2fbdb646260c03d97a907d38418774dcd7091ac0a2c7d9132
MD5 hash:
74ac2a89f2f0af5748b6799ec9c269b7
SHA1 hash:
0d0283233fda8689e188deec865f951aa7355328
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/46190222-7403-4664-9983-59ac64d1064d/
SH256 hash:
04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7
MD5 hash:
8e0342b0a50e046c2b22f6d9548024eb
SHA1 hash:
0378936325dd0a19ac2547ad462017db60d9d315
Link:
https://www.unpac.me/results/46190222-7403-4664-9983-59ac64d1064d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/188288/

Comments