MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8
SHA3-384 hash: a82325e539c5ccf8015739cb18924c29db885cf132cf8cb8978f09d42f20618af070d473ef3b8aaedc77028b3ca701ee
SHA1 hash: bb395bd38773d6d5b16ab03e70ba86f062dbfd17
MD5 hash: 35f7806dcd5b66d2d4f6b84ce1bfd934
humanhash: november-alpha-hotel-burger
File name:7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8
Download: download sample
Signature njrat
Create hunting rule
File size:146'432 bytes
First seen:2020-06-29 07:37:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 3072:YJLB/F/QT5xGS63QFNkAz5Q4CmHZmDXghrkej:wd9O63CPZoXSA
Threatray 1'126 similar samples on MalwareBazaar
TLSH 32E3FD18195F3232E16F5AB9CDD1F140AB5976DE1322DE4D2BF4E1C98213582F9A02EF
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15802/
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 18:28:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ozl4j7u6qfn4b476wggoe64rhtbj4sexpvyexgxsrdbysx5hft4a._file
Verdict:
malicious
Similar samples:
19f763b4199e2bee6affbd7a92bcd07f0234a3351a82a3df0e25ed48af1dc724
njrat
276a602f80ffef482b3387d2d8e9f6b7b71db5344a5ad0d8a5514e3c5ee0948d
njrat
3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06
njrat
448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
njrat
5f2ed2da6ce1c85c4eaec50866900fca79f27df2a3013ac416249130527bc96b
njrat
845d91eb6a8f0a630970249fad1e3aefade136454021298e14653bd5c35b52b1
njrat
8814e2f63b6df850a5805778f846a6577ab668c79ff822adb90917813acd9ede
njrat
993b9d7cb477a1471d4e0dd3b2eeb9b7dba82552df0f0dd20c0d9c861bde1a33
njrat
bbb44461205442d3644ee3137f495777b46d2cc9cc2039a6138571037c843342
njrat
e95ca33ca812ba4b79e965a53cd9d75d761baa830078dce5afc03147f038e87c
njrat
+ 1'116 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200629-3d8p5nz54a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15802/

Comments