MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 15


Intelligence 15 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b
SHA3-384 hash: 2109026a3d1c240e4bca0817a7419f042a987d1b145213075533f6604fea048d4722b1516ade170fc6307afd0ba7abdd
SHA1 hash: 74f6d1a20f48d9bb957629bde1722b3ad0832845
MD5 hash: e0ec5a5a993539cd1537ba638958f8b6
humanhash: golf-vegan-winner-aspen
File name:Payload.exe.exe
Download: download sample
Signature njrat
Create hunting rule
File size:1'140'399 bytes
First seen:2023-01-20 08:45:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:4TbBv5rUB1qTvrfCBOolPxRMa2tSim8BpcqK:6B3LbCrPN2ftpcqK
Threatray 1'035 similar samples on MalwareBazaar
TLSH T1F735E081FA8055B0DC665B316A36CD30963B7DB86E34989E27DD3E2B7FB72C25031162
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
194.5.98.13:5392

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
njrat
Create hunting rule
ID:
1
File name:
Payload.exe.exe
Verdict:
Malicious activity
Analysis date:
2023-01-20 08:47:58 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/23e69f82-0d07-4500-b84e-e877f182d7f4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/354868/
Detection(s):
Win.Dropper.Nanocore-9981431-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Launching a process
Creating a process from a recently created file
Sending a custom TCP request
Creating a file
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Query of malicious DNS domain
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/61696/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware nanocore overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/63ca54cb96add6d1cf47e5db/reports/3f8e3ece-167b-4e9d-9804-2ab5b429d896/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/452f1d0e-efb4-4326-955d-2bec7455f4d8
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1155389
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Starts an encoded Visual Basic Script (VBE)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 788121 Sample: Payload.exe.exe Startdate: 20/01/2023 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 7 other signatures 2->45 8 Payload.exe.exe 78 2->8         started        12 fkst.exe 1 2->12         started        14 fkst.exe 2->14         started        16 fkst.exe 2->16         started        process3 file4 33 C:\Users\user\AppData\Local\Temp\...\fkst.exe, PE32 8->33 dropped 47 Starts an encoded Visual Basic Script (VBE) 8->47 18 wscript.exe 1 8->18         started        20 RegSvcs.exe 2 12->20         started        22 RegSvcs.exe 14->22         started        24 RegSvcs.exe 16->24         started        signatures5 process6 process7 26 fkst.exe 1 3 18->26         started        file8 35 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 26->35 dropped 49 Antivirus detection for dropped file 26->49 51 Multi AV Scanner detection for dropped file 26->51 53 Writes to foreign memory regions 26->53 55 2 other signatures 26->55 30 RegSvcs.exe 3 5 26->30         started        signatures9 process10 dnsIp11 37 sylviaoslh012.ddns.net 194.5.98.13, 49697, 49700, 5392 DANILENKODE Netherlands 30->37
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2023-01-20 08:51:04 UTC
File Type:
PE (Exe)
Extracted files:
126
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iuc2qc2grzubmbdmsx4t7izsicjrj3dx26ikub7nndkljap65v5q._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
3441e66bd2febee7b35a6268f466b526628cdc2de0abab93b5cbf8a4c239d50a
njrat
39ea311cb6b0131d43cdbc20532029aae7f9239ed3b7e6a46c3c822741e8c655
njrat
3b58425d746d06b145008132053d1f57079cf757eaae75b589b7950f2d95f88a
njrat
3c86727fce52f4c23eeff8eeb9c37d0ba3ff63bf446e6fc4f61c39c201dac9b6
njrat
51ba2b6912305fd63c041dccff36db067314cab3f93227aaf21990801efa0b25
njrat
64359ddf637e15b2f3f8e0360d23caf8d2d5d51680b8709bde3eaa392978043a
njrat
b13fbd200b38f02c0278e54483e641a2cfb41acd1a90bed78ac8791d0c1cf5b2
njrat
ced55c9b4b3dba810dc674575818bb4d9dc828d3df6efee4a15d85ac24abd69b
njrat
d60845023b6f4924993a60e60e1db49c5b6cc9ede4e09560d3542dd5f1bee603
njrat
ffec1862f56857ad722abbcb98be7af86f2cf0763371bcb40273f0d884157c32
njrat
+ 1'025 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:hacked persistence trojan
Link:
https://tria.ge/reports/230120-kpajpsfc6v/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Loads dropped DLL
Executes dropped EXE
njRAT/Bladabindi
Malware Config
C2 Extraction:
sylviaoslh012.ddns.net:5392
Unpacked files
SH256 hash:
294a3668b9be5e14899583ccf8755eaf9abf717e30d4e2bcf376877ecda46d3b
MD5 hash:
fb9fbf42d7a1b9c02279839f3bb97a20
SHA1 hash:
58f651d7f101e67767bf25b20144163431b46eb4
Link:
https://www.unpac.me/results/2c98bdb9-f894-4658-b708-4053a05bc866/
SH256 hash:
40b162ba2b305740ac30a38e4520de8dfd01b8ab114fce49eb4b0a679940389f
MD5 hash:
61c57aee1a0d92dfe54f9184150cd5b5
SHA1 hash:
09678faeddc8f43f17152013a6aa2a5d7e4edf9a
Link:
https://www.unpac.me/results/2c98bdb9-f894-4658-b708-4053a05bc866/
SH256 hash:
4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b
MD5 hash:
e0ec5a5a993539cd1537ba638958f8b6
SHA1 hash:
74f6d1a20f48d9bb957629bde1722b3ad0832845
Link:
https://www.unpac.me/results/2c98bdb9-f894-4658-b708-4053a05bc866/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:CN_disclosed_20180208_c_RID2E71
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_attrib
Create hunting rule
Author:ditekSHen
Description:Detects executables using attrib with suspicious attributes attributes
Rule name:malware_Njrat_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:MALWARE_Win_NjRAT
Create hunting rule
Author:ditekSHen
Description:Detects NjRAT / Bladabindi
Rule name:MAL_njrat
Create hunting rule
Author:SECUINFRA Falcon Team
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_netsh_firewall_command
Create hunting rule
Author:SECUINFRA Falcon Team
Rule name:SUSP_Reverse_Run_Key
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a Reversed Run Key
Rule name:Windows_Trojan_Njrat_30f3c220
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/354868/

Comments