MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22
SHA3-384 hash: 6624716022d1d971c8f3401e6a813e5d197d2f7e3a7f5e7f030d610074b9baaae48dfc90420c3ce2b7c8328ba3235463
SHA1 hash: 928492c4763b427761f9bcaeec51ba533be8d32e
MD5 hash: dcc61969726dcdb49a869cbbbd03a316
humanhash: robert-muppet-uniform-alanine
File name:10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22
Download: download sample
Signature njrat
Create hunting rule
File size:132'096 bytes
First seen:2020-06-17 09:33:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:bwHNwT4TuMrKERO++tQMDhO8/VzGu55sZ6tkeZQ:bYNLBmEXszBrFZ
TLSH 45D3DFCDDFE880D7CEE9B97D4CA4BD0C5A11952E57D3E246DB00F2502BA26510AC8EDB
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19413/
Detection(s):
PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 19:43:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=caatvn4l4cnnovwmmqaf4k33mxhtajl5f4a27qjbfjvhya6e7ira._file
Verdict:
suspicious
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200624-te6vcj4sy2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19413/

Comments