MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba
SHA3-384 hash: f3fd3e127729a6aae452b0feedbb74fc75bf97078f68489c95df3e5e0cd6813a9701cbdcbf396b84189e71d4bf0405d3
SHA1 hash: 024b45653caf34d03c8d6b0d9c2cda7c76b13047
MD5 hash: e8f1a42cb61860ca3f6ec938192108e8
humanhash: summer-alabama-bluebird-mirror
File name:XAcKnsaN.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'768 bytes
First seen:2020-11-07 13:47:20 UTC
Last seen:2020-11-13 15:51:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:aLd5yh2Qc36M1CTaiD1ZzoWgsq5aTMg1ui2VkSYO9f8kLDOHYCFXPzlpmIMxTZis:Ed5yh2uM1fLJpVbDfmF7Kr1h
Threatray 399 similar samples on MalwareBazaar
TLSH 51E2E70533AA4713C63D03B90966471647F1CE83553BFB6F4CD9B4ED19BB7808A81AAB
Reporter pmelson
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
5
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
Creating a window
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 13:49:04 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b74h6jwyn2gefaloz2hwbujpghtwxa3uboxm2csy7bfajfqwlc5a._file
Verdict:
malicious
Similar samples:
0be50f5dccff35823a1735e676485141e3194cd4027cc0518c86f743284dce44
njrat
14ba5f94a671a38e16b5166ebca44ddacd6fde3226015676f9c369c992b5d2f8
njrat
2b942243439c92b4921032a08567d76c0baff766661083fe8f6a9ab66966926d
njrat
72186f2bd535a54efe912025ee41ff582ea5eeeb08709988e7e89e3822dbf391
njrat
a3feb1f837ab57c218bfb325fb808534d1f25ff26ff7a3a75578dc165c8a3ff4
njrat
af21243da675a515c8e2ca9d00b5628c1201125b1a29d46a9df0cb0b63769942
njrat
b2a9afcf53b4804d0d6b525b0480c1e01f72a151c536d2436e1ae2017d7bcccb
njrat
c49196fbcc615b4145c095b26fd716cb4540b0b7a58693eaa987ebc485e20865
njrat
eccc7b043b9cdcd8a3766cde17f331e63a6be6f7fb7a99e5cc7f6863406c299e
njrat
f2292fec01b4672cf1bd05d2022e7ab814c53378e900cf7679b3917fe317965b
njrat
+ 389 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201108-yy1dpranre/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Modifies Windows Firewall
Unpacked files
SH256 hash:
0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba
MD5 hash:
e8f1a42cb61860ca3f6ec938192108e8
SHA1 hash:
024b45653caf34d03c8d6b0d9c2cda7c76b13047
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/7a195f5e-3408-4b99-bf01-0f138adcb2bb/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:Embedded_PE
Create hunting rule
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe 0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba

(this sample)

  
Link
https://www.virustotal.com/gui/file/0ff87f26d86e8c42816ece8f60d12f31e76b83740baecd0a58f84a04961658ba/detection
  
Delivery method
Distributed via web download

Comments