MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
SHA3-384 hash: 3dc389b6f20851135c531b6a68b18fbbee35e8a089ac5bc21d267316f05a6b9629ba21f0b2876f91507386ada3a26175
SHA1 hash: ffc90dc3b1d875ff689a7e5353d1b72f1b7b6d0d
MD5 hash: 82b58741e7901c9da7c690bd708de23e
humanhash: yankee-apart-alaska-papa
File name:3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
Download: download sample
Signature njrat
Create hunting rule
File size:129'536 bytes
First seen:2020-06-10 11:42:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:8M3L2KaSwPs6i+/FRhXcbVAbjk4pqNTh6hAjyqOG:bL2js6LFRhm6onBhhu
Threatray 246 similar samples on MalwareBazaar
TLSH B8C35BD837E4EE63E64A6B3A90A707453779D8667F03E7DB9E8409390C623E63C04467
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 02:01:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzds7g5w756qlqkt2mzn2lplnzlgghcoqvdsvdaeufamughenmjq._file
Verdict:
malicious
Similar samples:
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
njrat
0f1f333f34d4ab91907ca6a0ad8d3360d5324623e9c885ab228127bce34932e5
njrat
2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1
njrat
380a0d5b3d5ae9eb9a53cf5bb4fe1737de62020e4f0ec5f56ee601bf8a884d1b
njrat
40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
njrat
439d5c2dcf14e2f1b24463094aafde50e9a5702e451a624c2078aa32acc194dd
njrat
5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0
njrat
e162d29d0ba895e3ea7d75000c41c843225c7d29147b323ed9a72f4de3c1f6f0
njrat
e3a5edee75299a8ddfa254fda955173f9063ec8081ba03d946f82f996a3b0203
njrat
fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
njrat
+ 236 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-ppxdxthd6s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments