MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51aa074a2328e0f001a6783b60d168a3bdc61dfc0248a32427fad1e096364e6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51aa074a2328e0f001a6783b60d168a3bdc61dfc0248a32427fad1e096364e6c
SHA3-384 hash: b20d0643fd7c4c0ecae9e9cc161a47b3586e6598b09744094c796b5517695f2bb3d4db4642281a2b35494db0fd353562
SHA1 hash: a9fd676a1dbca1481f7dde2db2fb9d79b6928c85
MD5 hash: 4ec5379b4f47fa04afeef3e71215de59
humanhash: pasta-north-grey-jupiter
File name:4ec5379b4f47fa04afeef3e71215de59
Download: download sample
Signature njrat
Create hunting rule
File size:90'624 bytes
First seen:2020-11-17 11:38:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:iPKLiDfcCsTdjS0EupawbrCosot9x4CaNPtqXLTDHVxwJCFYZC2fwZ5yHxDvIm+K:iP2CsTdjS0E4fbWosovOCSPtqXLTD1xu
Threatray 152 similar samples on MalwareBazaar
TLSH 5993BB5028FF656DF37686B16FF9E9F5CF6EEA211549B67B104043024B2DE02BD022B9
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Ursu-6874639-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Creating a window
Connection attempt
Unauthorized injection to a recently created process
Launching the process to change the firewall settings
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51aa074a2328e0f001a6783b60d168a3bdc61dfc0248a32427fad1e096364e6c/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 19:41:36 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgvaosrdfdqpaangpa5wbuliuo64mhp4ajekgjbh7li6bfrwjzwa._file
Verdict:
malicious
Similar samples:
0c2d1a82e5752227f70d785ad9a5a20b977b212c150c5c24d624f2a9b7ffe075
njrat
26c86f34572cbf285c030bfe691770189343873dec993b629c37c40403bf9a4d
njrat
3e065cb08c3849a2eefd0ac3037f47aa958e106179976c11fbeec34a6f0593d2
njrat
4e0d95ed4e6390e06c4dd40425dcd4988c74effd08a7ed0ae577491ac3e3c655
njrat
823eb07c909c332450374977a21f944ef0cbf2bed7403971053fa4e61b3b02f2
njrat
9d1452bdf6b380b7ac63d7d5de5b1a9b7e8fd01996b45b1f7194cd56da71d20d
njrat
b63b3bdb3a17fcd705b77c85d36db8a300770b267979b70cf2497614df5a4445
njrat
c2a8b81591a60318a09bcfd8d403cd7ab45018d40457e7ce7a86d2b1a4d6ac27
njrat
c3bec42ea8ccf078389aedf4292eba41e512c7e1103a86f7135adce541380ec4
njrat
f0d6d59f60cc928f5ac695965a73341f4836ee2c9c83deae91b3da1265e465f7
njrat
+ 142 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201117-yfsrkgs67j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
51aa074a2328e0f001a6783b60d168a3bdc61dfc0248a32427fad1e096364e6c
MD5 hash:
4ec5379b4f47fa04afeef3e71215de59
SHA1 hash:
a9fd676a1dbca1481f7dde2db2fb9d79b6928c85
Link:
https://www.unpac.me/results/ab4d3ccf-9265-4ffc-b812-53a49a33a05b/
SH256 hash:
86d77a29b5c01fa52b56d9326260f1b18481eaa75077ef1c737358333ac6a2bb
MD5 hash:
b9bca307f86b050727e3e1fb32146f2d
SHA1 hash:
8e5ccd6e8540c6d871baeb77b4eb7bad8dc46ef7
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/ab4d3ccf-9265-4ffc-b812-53a49a33a05b/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments