MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6259ecedb1761b7412454f7dbc6ac1571701e276c49213e8a9b8fe70e03c546d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6259ecedb1761b7412454f7dbc6ac1571701e276c49213e8a9b8fe70e03c546d
SHA3-384 hash: 0d309a6d692346b085a653998ddac3c1b4ee1d67abdf70657c68cae22fa6b57fc86aeba21209156d454d75165e7a698d
SHA1 hash: b255420bedd9e71bf29126da6d6d069e7d375900
MD5 hash: 8bb6bba5c982dc77692175fa9b7e7c8a
humanhash: montana-charlie-dakota-lion
File name:6259ecedb1761b7412454f7dbc6ac1571701e276c49213e8a9b8fe70e03c546d
Download: download sample
Signature njrat
Create hunting rule
File size:99'840 bytes
First seen:2020-06-16 09:42:16 UTC
Last seen:2020-06-16 10:51:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:Az1Ea7Z0aHIxV1cZeBsuFvYjuN1WbHSP84usWf:O1V/HIxVUCN1U2xWf
TLSH 7BA3DB7123FEA449F133BE31AFB5F384DF6AAA315215954D2880030B9875C82EE77676
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10846/
Detection(s):
SecuriteInfo.com.BackDoor.Bladabindi.13678.14367.3955.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 22:40:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjm6z3nroynxiesfj563y2wbk4lqdytwysjbh2fjxd7hbyb4krwq._file
Verdict:
unknown
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200624-nap6kq93ns/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10846/

Comments