MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22d63c0ca31019e77eb995fed035cac211e6d82e24e6d54105e26adc0c2d0373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22d63c0ca31019e77eb995fed035cac211e6d82e24e6d54105e26adc0c2d0373
SHA3-384 hash: 94da7e9845d99446cf6cb60f21553e094e0800703492d85295bb272080559a87d3ea0abdc48ca6b623579a7a069e187e
SHA1 hash: c04b8f0907575cac9e9c1058ab11733814394c29
MD5 hash: 00bba72f9fd1aaad1e083a27c14a7d2d
humanhash: michigan-failed-grey-ack
File name:00bba72f9fd1aaad1e083a27c14a7d2d.exe
Download: download sample
Signature njrat
Create hunting rule
File size:314'899 bytes
First seen:2023-03-23 19:15:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91e96141ed5dbe3bc541c8aad7ff3c38 (22 x CryptOne, 7 x njrat, 5 x DCRat)
ssdeep 6144:XdL2uWkVLRR1wOe85TjsugzAgT+tkE98F0lAylgQS:NLllHPwOl7gT+tkE98F02ylgQS
Threatray 215 similar samples on MalwareBazaar
TLSH T11B64B022B9C0C471D46618350AE5D7B27B3CBD301B264EDB97982F1E9F341E1AA357A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
3.127.138.57:19184

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
00bba72f9fd1aaad1e083a27c14a7d2d.exe
Verdict:
Suspicious activity
Analysis date:
2023-03-23 19:18:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5da3217f-075d-43e4-9176-a2eb7724bf9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376930/
Detection(s):
Win.Dropper.njRAT-9986242-0
Create hunting rule

Win.Dropper.Nanocore-9986456-0
Create hunting rule

SecuriteInfo.com.Variant.Fugrafa.267521.30514.22927.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/74470/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autorun bladabindi greyware njrat overlay packed setupapi.dll shdocvw.dll shell32.dll windows
Link:
https://www.filescan.io/uploads/641ca575a6b4db3649e8b550/reports/30dfbc68-5bad-4092-b60b-7725cd86da84/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/22d63c0ca31019e77eb995fed035cac211e6d82e24e6d54105e26adc0c2d0373
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f42ffb74-0b89-4b33-8ee7-fd6d2eea9624
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1200738
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22d63c0ca31019e77eb995fed035cac211e6d82e24e6d54105e26adc0c2d0373/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2023-03-21 21:19:00 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
29 of 37 (78.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=elldydfdcam6o7vzsx7nanokyii6nwboettnkqif4jvnydbnanzq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
376c8edbafb727e3c48081ac3c6751dd6b73e73462c2a26794b37cd44be4344d
njrat
6000cb4765d6219aeea0210a1ecec6af293e3ee6e330f560e30c043987f5aeb7
njrat
a864b81bd8c847b2818f8e9084bc0f1aa27fa3ca4a80e082a6c14ed8209425ab
njrat
cbacfe984cbeab12d25335ccadbd7a5ecbb2b1489357cc4cea089c4448ddfa78
njrat
ec07a4c3d4781b76afa30c9b8031f16ebac0be61ce71af0987c9ad48358ab6cc
njrat
+ 205 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230323-xyssvshf52/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
22d63c0ca31019e77eb995fed035cac211e6d82e24e6d54105e26adc0c2d0373
MD5 hash:
00bba72f9fd1aaad1e083a27c14a7d2d
SHA1 hash:
c04b8f0907575cac9e9c1058ab11733814394c29
Link:
https://www.unpac.me/results/c19d7a74-a880-4a3f-9425-3d9cbb61d8be/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/22d63c0ca310/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/376930/

Comments