MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
SHA3-384 hash: 917a340a0ede9c1291c5cdc105300f8fc84b521e17821cad545a6090e8ed4c755aa84d2a70917309dcaf92219db3ce35
SHA1 hash: f15364665c24119f9f9f939ce1d1953038f18b10
MD5 hash: 0e06d9b27105a9c1f55e25740b3ea86b
humanhash: blossom-kitten-emma-winner
File name:40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
Download: download sample
Signature njrat
Create hunting rule
File size:114'176 bytes
First seen:2020-06-10 11:53:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:T9iQ5IqPjedIzRbo8EhKKdpCbUi0f4YZ4CWfbt3dJ4j+RN9e8yv0VaYC:TAQ5IqaGbCKK6giBjDp4mHe/v0VQ
Threatray 117 similar samples on MalwareBazaar
TLSH C5B37DAE3BFEDE93C74D9739A45213946774E928BF82E7038994613F1D7239A2E01502
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Worm.AutoRun
Create hunting rule
Status:
Suspicious
First seen:
2020-06-10 11:30:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ic64y74q2k72jomzfa3h6374ufagka3wg6xghfaokarlbll7msga._file
Verdict:
malicious
Similar samples:
16e2fadef5bcf0f418643eeefcfd53fb2bf6f51b1f1419b9e973a3a06f1d358c
njrat
2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1
njrat
3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
njrat
439d5c2dcf14e2f1b24463094aafde50e9a5702e451a624c2078aa32acc194dd
njrat
5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0
njrat
73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd
njrat
7f8ce0eabde719c8e568ac741f48f0d9d931b3da8172b26e53af451ffcea1e10
njrat
a3d9ff9c48053f4e1ace3a4988f83763467735a5de5a40df41b8dba3c3c5c931
njrat
a71aa1ff58118ec6ca9cd4cdb4daf51eed8484ed0dffabad893e30803e06c62f
njrat
e3a5edee75299a8ddfa254fda955173f9063ec8081ba03d946f82f996a3b0203
njrat
+ 107 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-4rjn8xza1a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments