MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
SHA3-384 hash: 3b81f95a1959f13c9a0af9136bd7ba119130435bf6f1a884f5ad6465a54a9c0e3f071eae6e15efb1bbaf315997daf3ce
SHA1 hash: 730b60322d49dce92da84c413f21a6b187d45e36
MD5 hash: 984638709ea7257a056c5eea1e416667
humanhash: fifteen-hamper-twelve-september
File name:289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
Download: download sample
Signature njrat
Create hunting rule
File size:699'436 bytes
First seen:2020-06-29 07:20:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 12288:q2ghLvPhXpe3PlJqGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG+GGGGGGGGGGGGGGGR:KXhZgPlYw5dIJ/2k5GMPih
Threatray 252 similar samples on MalwareBazaar
TLSH 08E47D106EC5FC66E21DF03906B4C64745EFA91D2B23C956EFAAFD1875ACFCA2E11102
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15549/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.LuheRARDropper.19200.30796.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 23:56:30 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcn3t4qsl5rjixzzmdyp44rydlvabbjzwhdouknidllgxuxsi6uq._file
Verdict:
malicious
Similar samples:
1620114c000809b11104adbadb3df7ac989d9c7bc5e7da5acb0ffc9c5cb05c14
njrat
173b72dcad9c8376adb5c67014e15feb1a041f927a386e1dae6d609ff0e4a003
njrat
19a46210c60e8cb22ba56485dc16876532539f5a98713d16578253fd70649d61
njrat
30898e79c019a359c6bc25a0217531494c12cfe62384beadc861eb622b811378
njrat
5623df29bdeb9756ab512f3c77dd11725878939a0b8d98726798d8604ab60dfa
njrat
7611d90b7fb2e98a1d76569ac7b18e8daaceb1312b50b47a9ef5ae95c3946053
njrat
78c42daa9bd978e2e2ca039a54f167f5090681124f402fa9c9bd69a2dd23bc26
njrat
8b17398f591b8e917b1d436044e456bb88e2e482f9b82370dfe3acdcb92deb40
njrat
c87a719713c51891fa7b0def4b093441934d9f60ef8bd52951e2efb9a030f59c
njrat
d461810943d78b803fbc9a0ea85d16325af10764243d7d3d6b7b24d52efe685c
njrat
+ 242 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-f9q1y81lh2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15549/

Comments