MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9
SHA3-384 hash: ff000199ec1f1cbf0d9b67423938ca35db3cb51a1ac2ed26074694226030c997dc00faaf48a8249534878909aeab7f02
SHA1 hash: dd054587b966b94abc8e0b7fecb57e4f1713626c
MD5 hash: b1fbbb82ba785eb41c3a3ab5bc107e8c
humanhash: nebraska-two-skylark-robert
File name:b1fbbb82ba785eb41c3a3ab5bc107e8c.exe
Download: download sample
Signature njrat
Create hunting rule
File size:2'776'576 bytes
First seen:2021-10-29 11:12:06 UTC
Last seen:2021-10-29 12:24:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 49152:iTXIk2ssawvSLkS0oiusoV0GYoSE+RpMaJd+zbr8NRp1r73SGPXy/q:iTXCLSkSBsL9MaTabr8Ln3SoXy/
Threatray 12 similar samples on MalwareBazaar
TLSH T171D5120178B650C3D9A8133542925218361D9EFFB838F2EE5AF4BF4D5B74B8608DBE64
File icon (PE):PE icon
dhash icon f0c4c84862b2dcf0 (2 x njrat)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
91.109.178.8:5050

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.109.178.8:5050 https://threatfox.abuse.ch/ioc/239465/

Intelligence

File Origin
# of uploads :
2
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b1fbbb82ba785eb41c3a3ab5bc107e8c.exe
Verdict:
Malicious activity
Analysis date:
2021-10-29 11:17:35 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/e866d6dc-6441-4fe8-a418-13ab3cafbfcf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BackDoor.Bladabindi.16104.692.12772.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/31eb62ee-65e9-49e4-8be6-02cb24aec91e
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/879246
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2021-10-22 19:17:24 UTC
AV detection:
27 of 44 (61.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=junyerrulbwalmdesujqs3cxqqhi64d7tofylujgktymqnspecuq._file
Verdict:
malicious
Similar samples:
76ef13eeddb4b7717d5ec1d737b62c07dce1338cfb32fdf6c363d1fa189173ad
njrat
7bcfa2772341f0f169ee65c52cacae795e37e5107473f26301206f38f4622263
njrat
879b9e76f77d42573e5a683277f234acdedc05ecc865bf843399af5b07c4cbe5
njrat
c7cfd6eb7f84680ea18209845e54a70e7ab07accdf94a9ef5b7399a9181af92f
njrat
c8c205bdf3a94934d337f9548ee63fe504f6fec787f881ed0c344e01fddb1b22
njrat
ca3aba612c439f93628abccf59b1ecca8aec0af2c5073bdafec617b1857dd8bb
njrat
cf2519d7f487f8a64920eedf7446c626e41d6c0b8e7e8954f09214e12bbc7385
njrat
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata
Link:
https://tria.ge/reports/211029-nbes2shhcr/
Behaviour
Suspicious use of AdjustPrivilegeToken
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Unpacked files
SH256 hash:
8eb2986369eae79fb01ccfbd2aaae40cc22ef1ed94259279d78e8253e11db7cb
MD5 hash:
c2073747740e83b06dff0be6b9ee6fa8
SHA1 hash:
1306409b83eec1f605a58a44e2063cf073ff5136
Link:
https://www.unpac.me/results/c1daeb10-4857-4e52-b514-14c9e038901f/
SH256 hash:
4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9
MD5 hash:
b1fbbb82ba785eb41c3a3ab5bc107e8c
SHA1 hash:
dd054587b966b94abc8e0b7fecb57e4f1713626c
Link:
https://www.unpac.me/results/c1daeb10-4857-4e52-b514-14c9e038901f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments