MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7
SHA3-384 hash: 643eadf8b0c22d504d03b7bfad41054f7f7292d7195106d943129440d5acf60ad71bc4c948a6ead837022072e4357dc1
SHA1 hash: 1b8019d39ab977863528c76c4eea5ff069f6fe27
MD5 hash: 061cdddf9f734bb0e2ed62724e7c9da5
humanhash: grey-sierra-happy-don
File name:0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7
Download: download sample
Signature njrat
Create hunting rule
File size:79'360 bytes
First seen:2020-11-11 11:10:54 UTC
Last seen:2020-11-15 22:51:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:6cuZ+T3qTXt+5Mw+xs8tEo53PsDHPGali5JvzJ/U:6g6TE3I3SopYvDsDa
Threatray 32 similar samples on MalwareBazaar
TLSH AB73F84B76998362C8146AB580EB143113E2AFC73E33E6853F4C63DD6F41BA2DE41B16
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a process with a hidden window
Connection attempt
Launching the process to change the firewall settings
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 23:26:30 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bs3so76vzn256vnfkxce25gmke3tritvpdqfes6i3omerfumfldq._file
Verdict:
unknown
Similar samples:
125e065a5c11e10344ddc8ea6ba20a423a25903539a028fff1dfef3280dd23c1
njrat
1af23919d3e943f51b279e81dd75b9005ed22e550817e5e76eef825864e600d3
njrat
6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea
njrat
9492eb7a5698503c91c7b153d07c0f86585c00472b1ec3277aea43c1489201b4
njrat
ac9585a2b073ae83bd5447fa7be6aecd242a4b70c024bd200fd691c763878fe1
njrat
b34995ccc278079c90c5b876aec791c11bb42bad62105f284c4177b5c2b38dbe
njrat
e001e72719b0e3063050857cdfb3c42a38f2332366d002ba1033702961e7590c
njrat
e059cca6c626c423b58a8f3d7988ef4e31c69adde7fa2d4ca8c5c875cbf46a81
njrat
ed18c95fd9b1bffd9383b9db739d7178cb936c55fec7d1941e2b24284c138ebb
njrat
ee6861efb34507e2db4f9d2793e9bf11f1d454052770b8a0fae408775507b26d
njrat
+ 22 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201111-ql31lnvryj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7
MD5 hash:
061cdddf9f734bb0e2ed62724e7c9da5
SHA1 hash:
1b8019d39ab977863528c76c4eea5ff069f6fe27
Link:
https://www.unpac.me/results/30361268-8a68-4892-ab5f-ca450940113b/
SH256 hash:
f732768688eca7758364f3be904497695553a4abe4dbc2af65a1350498af2a83
MD5 hash:
ee34f9ef83d225a393421ed9ddc5852f
SHA1 hash:
53d8f6340165fdf105ec92108282d2bebaf53b10
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/30361268-8a68-4892-ab5f-ca450940113b/
Parent samples :
a4f850f05002e8a41697eb5b6d524c84a01a909696e41a2069834282779f9476
0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7
cebc70d2a5836d2a510eaf274a8e4e2e1ca815aa14fe31406cd05fda7ea7220b
90fc19cf116053e010661e4e5ca83f20775e115bcc8c8ab37a1e6893cc5a9579
deade334881a19f7363e189942a7870f8c5802731c3612bf014dacb78c4b5dc7
0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930
a73fccf6d081c208ac2eedcca5361caa5599ae136bbda047b3d70f2857c81fc7
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments