MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 490b24ae49c3a9a3c8f580ed6847c8c96f9027e5be9b122e49728c7dc8ee0498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 490b24ae49c3a9a3c8f580ed6847c8c96f9027e5be9b122e49728c7dc8ee0498
SHA3-384 hash: 5e41563c22dceb3cce654629d5f9a58d6b7fb759e0f96a0a52be34bc402c01d7ed9d907dfe34166f2c937f843fb45d32
SHA1 hash: 32e50897d870c8f203ab80e6dbfe4ac648c97d18
MD5 hash: c25f8e690b01154a390512c446b1e376
humanhash: fix-low-ceiling-kentucky
File name:490b24ae49c3a9a3c8f580ed6847c8c96f9027e5be9b122e49728c7dc8ee0498
Download: download sample
Signature njrat
Create hunting rule
File size:480'768 bytes
First seen:2020-06-10 11:52:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:nBLL/nAqBLL/nAqBLL/nAqBLL/nAqBLL/nAqBLL/nAqBLL/nAqBLL/nAqBLL/nAA:FLLLLLLLLLLLLLLLLLLL
Threatray 58 similar samples on MalwareBazaar
TLSH B4A4AD15749A363BD022CEB506F5FDF0CAFEE9231407F27D2D90228A87B15476A4D9E2
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Ursu-8015308-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 02:02:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jefsjlsjyou2hshvqdwwqr6izfxzaj7fx2nrelsjokgh3shoasma._file
Verdict:
malicious
Similar samples:
16c471d08b96936bdb1894c8fd1f17cbee466160e8cfceb9fce8addb62bfe86b
njrat
282406408e4499b5e5807fbb08409ae8c1456efb75281da653d366dad299d5df
njrat
31be15bca048be274cf57fe357a7fe192fdf045cd2c93c2e13a42972db30ddf8
njrat
448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
njrat
5564f628b877cee2359d1b9321ec6c4ae20cd4d168ad678afeadf126608af514
njrat
b1e31a390090f5cf702231368b8da3da88679c45ba9f98775ee03806dbd31f87
njrat
ba0465f9805638d867752f4b39af069dd4ae1c172c44fa3fa501f746761b94ba
njrat
c33d8b5589880c1a82f257555f5dea36190e409cff9b2980ab80b314ccb11bae
njrat
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce
njrat
e34a91674a3a3aed881705d2f7deee4607a96a9abeb1a4a8fcbdbc9a3a560937
njrat
+ 48 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-m25p9ecjxs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments