MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930
SHA3-384 hash: 3414c5d4bbba0e2049c225cb2ee2361c146110a764c321057909208564b0199395799ee9129f5584a0a498b279fee180
SHA1 hash: bab7bfa07326fa1c1b827971fcc5b1f0cecc22c6
MD5 hash: 4c2b55f7eb9a3f2ea7d1267d9b19a3e6
humanhash: crazy-carpet-delaware-bravo
File name:4c2b55f7eb9a3f2ea7d1267d9b19a3e6
Download: download sample
Signature njrat
Create hunting rule
File size:119'296 bytes
First seen:2020-11-17 12:09:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:fZDDDDDDDDDDKk9whdS4MOH6Fae8qERNtfuQX3i3nMyIe/e7ezHoA9KyhYeLyr3:f14MPce8bV/ihIe/e7e9mr3
Threatray 56 similar samples on MalwareBazaar
TLSH 8EC3DF383788E652C825D4F61D86C3A0866D7D54FFBED1A7768A730F2977F200991AB0
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Connection attempt
Launching the process to change the firewall settings
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930/
Threat name:
ByteCode-MSIL.Trojan.Gorgon
Create hunting rule
Status:
Malicious
First seen:
2020-11-08 16:40:59 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6v7chhssbmf4del3ohhqqw3ce7o22lzsy4burutionzacmrneya._file
Verdict:
suspicious
Similar samples:
0ac85217c0d9160cbadcb08a6e3bd67ef33e21d7953ef4d151c1034b684c8c3c
njrat
51b94fffa69d6b2d5dde4e95db31331af0ade93a78cfb0329287e6d4e2402334
njrat
57f7751d3e603698a3a53a30ffc0dff8ba5591f17ecdad8a53e169585c46c041
njrat
5dd32541779e850c3a23207dc90a534dccc57dcdee4731f372c493645620cd8c
njrat
5f2ee5eadbdfdf968377e2c6e59dfc231d80bb70f70315123be088ef3379303a
njrat
81e99b7eced21488cba79c5629609ddd1e2f2ec19dfbc8cd2cabfa227c64a454
njrat
896970f29db569a86d7140e4ef9e1834dee6af5d9caded74b887358fa469c817
njrat
a96c325c0ea8731f69e015dae013fa912c3e15c8527512c50c34e18b6a090bcd
njrat
dd14a1096956425515cd7231df84a23f3b8a99aacd272d10994c592404d46ca2
njrat
e1f3196de43d520cf6dd77c3da924611a16072ed5a3ce3635f868fa2e8f98e95
njrat
+ 46 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201117-5xxmby2mv2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930
MD5 hash:
4c2b55f7eb9a3f2ea7d1267d9b19a3e6
SHA1 hash:
bab7bfa07326fa1c1b827971fcc5b1f0cecc22c6
Link:
https://www.unpac.me/results/54bd62cd-0465-44bf-aa36-41dc6f8ab9dc/
SH256 hash:
f732768688eca7758364f3be904497695553a4abe4dbc2af65a1350498af2a83
MD5 hash:
ee34f9ef83d225a393421ed9ddc5852f
SHA1 hash:
53d8f6340165fdf105ec92108282d2bebaf53b10
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/54bd62cd-0465-44bf-aa36-41dc6f8ab9dc/
Parent samples :
a4f850f05002e8a41697eb5b6d524c84a01a909696e41a2069834282779f9476
0cb7277fd5cb75df55a555c44d74cc513738a27578e0524bc8db9848968c2ac7
cebc70d2a5836d2a510eaf274a8e4e2e1ca815aa14fe31406cd05fda7ea7220b
90fc19cf116053e010661e4e5ca83f20775e115bcc8c8ab37a1e6893cc5a9579
deade334881a19f7363e189942a7870f8c5802731c3612bf014dacb78c4b5dc7
0fabf11cf290585e0c8bdb8e7842db113eed697996381a4693439b9009916930
a73fccf6d081c208ac2eedcca5361caa5599ae136bbda047b3d70f2857c81fc7
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments