MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594
SHA3-384 hash: b1dcb5ca94ebfdb22b469560e5bb49bca36217bfffb4c6904898b2a88e0920a5ca2164651f938be3c1bdbc73c5c2de70
SHA1 hash: d767fdf6e2bf7401dc15605bc44adcf59c563661
MD5 hash: 1abea96a6ae72ab101a28e5ce0342ff6
humanhash: may-winter-oven-oxygen
File name:59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594
Download: download sample
Signature njrat
Create hunting rule
File size:227'796 bytes
First seen:2020-11-11 11:34:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 3072:YsXRmUIMitiqQ0Ze27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwBmyhOu:ZR5IeqQ0ZeGk7RZBGxAycKpSPX2F
Threatray 37 similar samples on MalwareBazaar
TLSH 81245CA534AE6709D93EDBF0D2E520A087B562657216D2BA6C8153EFC051FF11F82C3E
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Bladabindi-6888152-0
Create hunting rule

Win.Packed.Bladabindi-9754048-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file
Creating a process from a recently created file
Launching cmd.exe command interpreter
Creating a process with a hidden window
Running batch commands
Adding an access-denied ACE
Launching a process
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Enabling the 'hidden' option for recently created files
Launching a service
Using the Windows Management Instrumentation requests
Connection attempt
Setting a single autorun event
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/532147
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to a pastebin service (likely for C&C)
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 315183 Sample: gGe1o9DldL Startdate: 12/11/2020 Architecture: WINDOWS Score: 100 82 Malicious sample detected (through community Yara rule) 2->82 84 Antivirus detection for dropped file 2->84 86 Antivirus / Scanner detection for submitted sample 2->86 88 8 other signatures 2->88 8 gGe1o9DldL.exe 2 8 2->8         started        12 gGe1o9DldL.exe 2 6 2->12         started        14 gGe1o9DldL.exe 2->14         started        16 4 other processes 2->16 process3 file4 58 C:\Users\user\AppData\Local\...\WinFax32.exe, PE32 8->58 dropped 68 3 other malicious files 8->68 dropped 98 Creates autostart registry keys with suspicious names 8->98 100 Creates multiple autostart registry keys 8->100 18 WinFax32.exe 24 6 8->18         started        22 cmd.exe 1 8->22         started        24 cmd.exe 1 8->24         started        60 C:\Users\user\AppData\...\mfc140enu32.exe, PE32 12->60 dropped 70 2 other malicious files 12->70 dropped 26 mfc140enu32.exe 12->26         started        32 2 other processes 12->32 62 C:\Users\user\...\rendezvousSession32.exe, PE32 14->62 dropped 72 2 other malicious files 14->72 dropped 28 rendezvousSession32.exe 14->28         started        34 2 other processes 14->34 64 C:\Users\...\Windows.Devices.Custom.ps32.exe, PE32 16->64 dropped 66 C:\Users\user\AppData\Local\...\SCardBi32.exe, PE32 16->66 dropped 74 4 other malicious files 16->74 dropped 30 SCardBi32.exe 16->30         started        36 2 other processes 16->36 signatures5 process6 dnsIp7 76 213.183.58.4, 5558 MELBICOM-EU-ASMelbikomasUABNL Lithuania 18->76 78 104.18.48.20, 443, 49751 CLOUDFLARENETUS United States 18->78 80 2 other IPs or domains 18->80 90 Antivirus detection for dropped file 18->90 92 Machine Learning detection for dropped file 18->92 94 Creates autostart registry keys with suspicious names 18->94 96 3 other signatures 18->96 38 schtasks.exe 18->38         started        40 InstallUtil.exe 18->40         started        50 2 other processes 18->50 42 conhost.exe 22->42         started        44 timeout.exe 1 22->44         started        46 conhost.exe 24->46         started        52 3 other processes 32->52 54 3 other processes 34->54 48 conhost.exe 36->48         started        signatures8 process9 process10 56 conhost.exe 38->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:38:17 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1a9b159c9210f631ce9963a5ad26bcb33f15bb0bbd3a17d080f41f8c7f294117
njrat
2aab2c226afa316a1bf2acf61a425dbe741007b6712b5ef0c8f969bb1cc39717
njrat
431ecb18d6ffeafbf69a79c32166607d24fcdafc9f4fd29b437d41b6272c07c5
njrat
57f7751d3e603698a3a53a30ffc0dff8ba5591f17ecdad8a53e169585c46c041
njrat
715b982e68ba71b962e694ab87e386a1b527d0ebeff3f6aced8badeba8a6a4d5
njrat
74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768
njrat
a96c325c0ea8731f69e015dae013fa912c3e15c8527512c50c34e18b6a090bcd
njrat
af4cf51f4a1e29d76867b510c0d7fae11f20b43e2405c85986b5e957ea6f00cb
njrat
dd14a1096956425515cd7231df84a23f3b8a99aacd272d10994c592404d46ca2
njrat
fb80a3973312b0ca4905ccba10408931846a3517d6afc64cb05271da85190aba
njrat
+ 27 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware
Link:
https://tria.ge/reports/201111-k15wqsh4as/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Modifies service
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Deletes itself
Reads user/profile data of web browsers
Executes dropped EXE
ServiceHost packer
Modifies visiblity of hidden/system files in Explorer
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594
MD5 hash:
1abea96a6ae72ab101a28e5ce0342ff6
SHA1 hash:
d767fdf6e2bf7401dc15605bc44adcf59c563661
Link:
https://www.unpac.me/results/3cdb8ea9-fd47-4f1d-b56d-1be7855a19ca/
SH256 hash:
8d36523c3497a55bec68581e9ebd086937041ae8b08333714579e4d0613f32f4
MD5 hash:
274b30068e67778e7456136912e20a9a
SHA1 hash:
668d1d93131b809b36533ee3878d2fbf89bc4640
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/3cdb8ea9-fd47-4f1d-b56d-1be7855a19ca/
Parent samples :
ae0bb2188564cf0be10c593014185c8d3070d7a0c1ac697289e16f44a94ea9bf
f260d2bd2faf0070541f6bf9fb54409c93542ac63fd1b867f26e2b8bb9c79683
8b796fbdda7bc3af7953460a939ca68f12b5a89f7308063d529306e85186b613
eef2aeb3969d6fb07824f3a707a9793e7a7df7177dae7c8a49a646042357cb72
522e738ca2b5cce42335ee991ee4a860946959bdc511601ca79bc3641e175982
9f813bdb1243bf3e32cccd51693ad9b7cb7cac64488d57361e27123e34f50637
c310041057c61f3ba5d7e208fe29c10e3fbc19c15382d35ae3ffca726de740f7
a775aa0cd648d35b6ee27abf0e3d5613ced39881933e2e47a9e85570994c4471
5d0809147bf64d10f4dd6a4dda843236c28cb615bc292e8aa55ecffd641ecf5b
da7a459f4c1ab50aad169d8f9de72842bc435c51a56222dde71dc884a49c69ed
6fb76ff6232bf40b4038357cf3dd6bfc5ba0074f5b967f9bdfb6ed174716ce6d
4c4c295c7c05c0e6310405e7c13d339177584d4aace8dcfb050dd2a8b2f20ddb
9fcac2cf17c2ba26a84eeba9e33a1b2e7596dd47797c1cdf3f2b8cf5d6a1e2a0
5d3a038b03d34a823e521cfa703a4be74239ce1a262352648d4a05272b1794b7
1366597cdaa79ecba85924576b320da134bc36af87e55bdafc1567a0e4dfac58
b8c0a74ae7032711bf6cba469ab3acc3b449ffa0eb06553b94cb72c88702b480
c53777452d448f4fdaa1402df21addddc91212f822f96f2f13d151eba6484776
afe31e0a4370e2cf1c65b2e8e3240b36ff78a6b53591f2b58975f31c51819a91
ef352eac885284748d693da2c13f1d0de8ebb37690edac253dc5ba2ef8b7e034
7c50be459a225b193787f95dcf9df17040bce012a976aa0d331cabf2057a5dc9
0be126377c4c1e964a48d29c93777e4721fde808c4f493fecefcaa756fef04bb
7604ab964cc40610d53feac0b1ad034c6e4e4293344670d1d2d7423e08e12a3e
431ecb18d6ffeafbf69a79c32166607d24fcdafc9f4fd29b437d41b6272c07c5
45e6d88e68a7ea1b3d12298aa67358c4bd281c9d7b3bea2b6d8093f33251bc19
4d0b222eb1fb0f8eff816b7b9515d3ee5d2477caf50e8f3100775914d98b3da0
ed5ddfee65c3f6a4460cc0df1ce9cc315aca290b635c079c3a23ec778a740736
ae9737ae6a42cb6df2c9f0fe0e95f3c71ebe416c2066ed01678e8fe93ede0d64
715b982e68ba71b962e694ab87e386a1b527d0ebeff3f6aced8badeba8a6a4d5
469f24e0e7b4effd12619297c22d0c3438d74359700f056ffb73f332e7f132d1
620c5624f6cba50cccf87ac71db3a403aeff574293d8f9d9db0ef6f2324194a5
1ddb36c08dc8281daaa61db30622c10aafe22ce74d57a120dfd68876c12ee0eb
a4c557f62eeee8d90d0536dc2c2c19fd15cb0ee77acbb0a1712255718e449336
cfa87db4ec71f808e7b4c75e91e78f9e41c9e18b49ffc1c7f86efbbf1f774920
d294f0307b2a951f12b879a7ed51bb42b89ac8e300c2cb3aab607601aa2663ea
2bccb08ad6826c1c43d2f17662ec80f4522eaeb9d1c3378b4b04b55eebcf510b
6555c6326fa0b15ae7a79a097cdc2c4fff83c3dc1774e6fa930b0f872f4ea12e
dc177d359dab235b049e352c44b66df001d24423b5be423299ca51596a4ef407
59bd5cd505abfbbfa179000812546405d0f81191bdb7656ef5cb04f41da84594
adb8a2adf73efdc0edd4e6ca9578c11e06f54a266b0f3760e4e42f5690a8dedd
69991a160f4e611ecbb9b471ddaf4eb771f1079b742e5c9ab1b96a1b47be5824
f3ab7b0f14524b29001843987c2623fb1bd50d5a3b0e0299b66073a7e32b1954
66ab390ad4d41c2ab0c356cce9ecdabc25d201133c9940102a231126692f8c2c
d09b8bd7afac11b175a8b7a8e914ae0bc6d029b4a3da1d43cd93642c5014e0f6
c2cd8fbc6d1dd494eb1835cacbac4a6380d7d633cb16725a8623858720850f89
67e66644ba3666cda9f16e669e5beb2469dfebc3bf750d1eb26dd87672a03eff
af587c42c113a6ada5ff3efb1e420083d8837f8c9e9af191b0e3612bfe983a3b
215aa27fb9204bc61a5c78c04c88b93f5753a87bab5916b05bcde1489195f620
39c4855ba040354ede0f2310cf6f53d279dd2eb4bf880c2af387c4337231f423
17d98a7809ebce6c45283b6612dfa6a76449a5ce1936d266052ef5a0daba6aba
b5d6f752632f2580013753c4b8c1bb606b7ecff9a2def27aa63e8c1d159ff029
359befcfa905259c92b85b52cd76583fa29afd1f9db65a6fa0d74cf545eca416
0ac85217c0d9160cbadcb08a6e3bd67ef33e21d7953ef4d151c1034b684c8c3c
ec007c8e1d3eff0ea195a14ffd738ae75682c599be0d0eb2b8c2a3f53f3cf7bb
4e0d4259a61aa9e2b5a757b2a30921ae339db3133ce4c6a82703d888447f764b
81e99b7eced21488cba79c5629609ddd1e2f2ec19dfbc8cd2cabfa227c64a454
5b3c373b0510e82659a5ad61c6216c5bedc0b976b4dcfc70d7a816aa7ab48912
ad26f3fc69988d25cb139d58508fc4179c1eb74b4fbbe107b1546fed90826f50
9cc56fc0be5cda9026b4690aac95958dbf47aede3778ef1f2ca5f731d0725bfa
e1f3196de43d520cf6dd77c3da924611a16072ed5a3ce3635f868fa2e8f98e95
fbdb9064cbd73c082bc28cb5e0feba72d9650a77bc4ed6e3bb3ea3292b877d26
a6e3c2896dca05b30509204fcbdebeba6bac0d532885223c8b1231556d090318
0b45ec54b1f826b2fa2435641ab3fec987f79d2e6d51d5f62d775a130240c9a7
f833bc41b10af2a39fd6dd2c7110f6b985f62d2b48877944ffea1b22aca7135a
113787ead4b84ee2470eb093c04fb255ca8e19d28e6aa917715af88d8445b2c8
62c383f13dbaf92d5ef3c13562159ce09b34a28eb0890c21fc1dc60b7f72e70f
5f2ee5eadbdfdf968377e2c6e59dfc231d80bb70f70315123be088ef3379303a
165a67e06e500ee045201cd1b8b69590818f675778d7cc63c0e88dc2f90d45da
73cf14ba8f82a22fa4b4b7eac472402694d6627e8dca87aab539f86b5b29b330
c37e302a34b0f7d9612fe035de8997ff1ba4c484752343b568e8a56e37ebaa44
f1f1f5abdd9c67fa5cc2978bf2ab96877677f68f355212d95fc59a2868106013
43b916bb0a763cc21f2ea6f024a487a3b64871e503834e36e69a967aab57ade0
7eb4927982f1215ec8031e88b8446f664ae7cf00f70aed9fcea66a825a166164
5921e303d3116f1fc51290b7240d46b2e777259f1f34bae181b8597bf56455d1
1f8f75da2e357c96253a6b8f542f9f8b05cadbc2889cd9ec2bc34f6dd869002a
eeed040e65a02ee46a6f96cb5a9fcc6c3f5105cf7d2683033185dc5914986739
22d821e2efa90bc9d03000f9fac7f5da07bedf73029c6abbf465ee01331ddee4
a0f3cf58d766d8fd9cb4e3dd039301f7d23c5b842355af81d9f7806285fdabd3
e649cbb817a27e62206a17a21f4572dcb20715722a8cf342c3d3cac4d34844bb
39f0f1efef09f55c07be71d8907de6893a687f2c2b903244e839138c1eb2b9d1
1d91cf0fdc2926cd56d050f247bb94580090de0b3faf010079cdb232b48da95f
57eb8408f83634e72aa1b2346835ad80a7bdae804fe4adf5239ed1c7f0c28bd1
95e114d89730e67a05f9d4d72c94a9e3672f8a22bf00c9c35610824346621a99
2dbaa0995d858b0d3001fbd86893b5e9e4e3af0f42d272e441facd3657c227ff
7a03fe067b3483e72e9f75a6e19192d471e387f4413186c87c81fc52c1e0d6f6
7050e97744b56887bf6eb62ddc1182f406d97b11e37d2bb3378e6886b4d2cc6a
c76dff7fb13cd1cae2a39d89293bf2e2e60fa4eefd2103229d6898ddab216e88
5b36ac5ee034c22487b508e1abdfd727358f48547cd44e9b97a30f46c8acfb72
8800e4e49a32f19984d012bfaee13e78d3822a20e8eefa3647c95702bac8c6c6
4fb18c226288c21a85362cff5ce18d36b2763d5016dd93763a51adc252111e4c
aee1c70039b8b79245942ad7c58cecb6e66872e890e3df0900cf2fb8c0bc2c81
f4a11d639c632ffe98fc7b8eeb1e3ab3e55c5e09f2b19dd954e3d08097376c29
80cf0a6ae977700f2ef2471c3c0d4e00c915adefd601e7dc27b1a24d23f3b3eb
590d444011e9899f3bc5fcb9524cdfd14c0846769fe1b13b6c890e3c9578753e
0a7053467cdd1d2315b04ff0959d7e71944800329b65dc2cf410309eeb3cac31
39d30771fd94402b82342039576ed15b60151629fd494f314433a208221c11f6
e61610581a1b4bdaa94b70076840318862fe4bcf9e7fe3d85cb4a83ae4f43e48
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments