MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c44970a8dac312c9bef34b036dc8e111c95867629d6a6f7d3cd43b62f8cc238. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	0c44970a8dac312c9bef34b036dc8e111c95867629d6a6f7d3cd43b62f8cc238
SHA3-384 hash:	d9177dcfdc0203d57895d418cac230ab72f441b52dde12f1ad60eb3fceb95446097c90725c43a1de5d33a48cf5ad8dea
SHA1 hash:	0bf9c31efd4c66e13cecd5823a42adb58f36a495
MD5 hash:	f4be942485fe6c4d0e5b9a6ad499318e
humanhash:	utah-maryland-sweet-potato
File name:	Balance Payments 10232022.r00
Download:	download sample
Signature	njrat Create hunting rule
File size:	2'842 bytes
First seen:	2022-10-24 05:39:54 UTC
Last seen:	Never
File type:	r00
MIME type:	application/x-rar
ssdeep	48:ZSRXrwq1fKT9dZsM74O//CYm7uDCZ0NOxR3vQvpGoS+EzwXv59AjQO+516oWJCJD:ZShw0KT9d974KCRL0NOxNQ/ZEMXv5ZOw
TLSH	T106512A5E4FCA103269CC2DB63A1189CA14237AA924E640B5A3DDD3D07C0742E227B38A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	NjRAT payment r00

cocaman

Malicious email (T1566.001)
From: "info@alnahdhagroup.com" (likely spoofed)
Received: "from [45.139.105.131] (unknown [45.139.105.131]) "
Date: "24 Oct 2022 07:38:36 +0200"
Subject: "Balance Payments Request Paid"
Attachment: "Balance Payments 10232022.r00"

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Balance Payments 10232022.exe
File size:	6'144 bytes
SHA256 hash:	82a7cd35e0da9d355890714cb0cb18b07f4477b16706562c88cd61227a6e62af
MD5 hash:	1b66661c82479490768900cd192712ad
MIME type:	application/x-dosexec
Signature	njrat

Vendor Threat Intelligence

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c44970a8dac312c9bef34b036dc8e111c95867629d6a6f7d3cd43b62f8cc238/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2022-10-24 02:47:53 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=brcjocunvqyszg7pgsydnxeoceojlbtwfhlkn56tzvb3ml4myi4a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/0c44970a8dac312c9bef34b036dc8e111c95867629d6a6f7d3cd43b62f8cc238

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.