MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b2c5362887dbc350aae004bee2ea50b83aee63bdb1d88c2559672e9ca5b91d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	8b2c5362887dbc350aae004bee2ea50b83aee63bdb1d88c2559672e9ca5b91d5
SHA3-384 hash:	dbfd4feb2dca28da8bfcba833337c7d099b2242f75c9a62c1dc70e730908c19fd80ce860fe15868e56d63e503b080e3a
SHA1 hash:	0431e4267984b5de5c0eb54d377bc43e3b377543
MD5 hash:	ff549236bf0eebcc655dc7ccbc5e0691
humanhash:	vegan-maine-london-mississippi
File name:	EdCEbXQu.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	37'888 bytes
First seen:	2020-09-29 13:02:21 UTC
Last seen:	2020-09-29 19:47:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	384:DCDvkit2Zf5W9cTYXyc/lPM20zHFmnPuhurAF+rMRTyN/0L+EcoinblneHQM3epR:WDqjjTYic/lkEPuYrM+rMRa8NuO65t
Threatray	84 similar samples on MalwareBazaar
TLSH	DD032A4D7FE18168C5FD097B05B2D41207BAE04B6E23DD0E8EF564AA37636C58F50AE2
Reporter	pmelson
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Win.Trojan.B-468

Win.Trojan.Generic-6417450-0

Win.Trojan.Generic-6454614-0

Win.Trojan.Generic-6454615-0

Win.Dropper.njRAT-7436651-0

Win.Packed.Generic-7672854-0

Win.Packed.Generic-7672855-0

Win.Packed.njRAT-7672853-1

Win.Packed.Bladabindi-7994427-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Enabling the 'hidden' option for analyzed file

Creating a file in the %AppData% directory

Creating a process from a recently created file

Creating a file

Enabling the 'hidden' option for recently created files

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Searching for the window

Creating a window

Connection attempt

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Launching the process to change the firewall settings

Launching a tool to kill processes

Creating a file in the mass storage device

Enabling autorun by creating a file

Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file

Result

Threat name:

njRat

Detection:

malicious

Classification:

spre.troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/477393

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to log keystrokes (.Net Source)

Creates autorun.inf (USB autostart)

Creates autostart registry keys with suspicious names

Detected njRat

Drops PE files to the startup folder

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Protects its processes via BreakOnTermination flag

Uses netsh to modify the Windows network and firewall settings

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b2c5362887dbc350aae004bee2ea50b83aee63bdb1d88c2559672e9ca5b91d5/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2020-09-29 13:04:06 UTC

AV detection:

28 of 29 (96.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rmwfgyuipw6dkcvoabf64lvfbob25zr33moyrqsvszzotss3shkq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

evasion persistence

Link:

https://tria.ge/reports/200929-4qenpgj9x2/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops autorun.inf file

Modifies service

Adds Run key to start application

Drops startup file

Loads dropped DLL

Executes dropped EXE

Modifies Windows Firewall

Unpacked files

SH256 hash:

8b2c5362887dbc350aae004bee2ea50b83aee63bdb1d88c2559672e9ca5b91d5

MD5 hash:

ff549236bf0eebcc655dc7ccbc5e0691

SHA1 hash:

0431e4267984b5de5c0eb54d377bc43e3b377543

Detections:

win_njrat_w1

win_njrat_g1

Link:

https://www.unpac.me/results/a4e49ec3-e46d-46bd-9488-8577e7b1caef/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NJRat

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8b2c5362887dbc350aae004bee2ea50b83aee63bdb1d88c2559672e9ca5b91d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Andromeda_MalBot_Jun_1A Create hunting rule
Author:	Florian Roth
Description:	Detects a malicious Worm Andromeda / RETADUP
Reference:	http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/