MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d444b092b7ecf58ed369d3510d15caf3fe357ea9fe32945b3263f51dda0285d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d444b092b7ecf58ed369d3510d15caf3fe357ea9fe32945b3263f51dda0285d
SHA3-384 hash: 2fd6ad32a6086f65ba570ed1df538fd34a85669fb6f04006fd47e4f97dd24480d1265655e6c0dc766c3002fdd2c25400
SHA1 hash: 01e47b96c6c25fe5171e58c3d2f34509382753f5
MD5 hash: 2ec7fcf2f33027a8f37afda2d43b41d2
humanhash: happy-failed-kilo-whiskey
File name:2ec7fcf2f33027a8f37afda2d43b41d2
Download: download sample
Signature njrat
Create hunting rule
File size:136'192 bytes
First seen:2020-11-17 11:55:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'481 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:hAvektIN0DTiBzTizAib61ZIann9mRimUMuLOkDnFML8EN:yveaIu2d2vYn9XMuFDFML8E
Threatray 31 similar samples on MalwareBazaar
TLSH AED34B4BEF09C56AC47D6277DE334AA011E5C6499D82E77B04E8BD393D6328C60A7F60
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Creating a window
Connection attempt
Unauthorized injection to a recently created process
Launching the process to change the firewall settings
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d444b092b7ecf58ed369d3510d15caf3fe357ea9fe32945b3263f51dda0285d/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 10:45:10 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvcewcjlp3hvr3jwtu2rbuk4v476gv7kt7rssrntey7vdxnafboq._file
Verdict:
unknown
Similar samples:
031b235aecbb9dd278dd748679c3103920a23a7f7eb5938b328346a7e45eece7
njrat
22a0867e6ae5a3ab5accb025d17d06bf038051a47a0b86dcbe1ebf38160e609c
njrat
2a46e0846fb5b909da9df065c96a2c482075dac2d57bc5bc02d70954e9c7e7da
njrat
6952d61c1b90bbe292626eddde290f0649ff02beca59738bf0912f6e1491538e
njrat
809559ef4f0a49166d9dc44908bdc206688523474f58742b12cbd47760b3fdaa
njrat
927f575e760758781d405edb7a7a16bd4a8069babb55a4bde1103f235fe0b602
njrat
9970470d471813416b034f776f44ce2d8beda6ff4fa38193bb18b2c450e24326
njrat
c1dc52285b9b9c38bdcfd347559f64b0de7394a8f66714e3b9148216fc91a411
njrat
c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f
njrat
d16901bccf3099bf8bc4aaa4f435f3bafe4bd6c990a6f898011de22dd6f67163
njrat
+ 21 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201117-aatfc75ffs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
9d444b092b7ecf58ed369d3510d15caf3fe357ea9fe32945b3263f51dda0285d
MD5 hash:
2ec7fcf2f33027a8f37afda2d43b41d2
SHA1 hash:
01e47b96c6c25fe5171e58c3d2f34509382753f5
Link:
https://www.unpac.me/results/042f3c8d-f51a-4404-822e-e85c6a74dcce/
SH256 hash:
9f4725ec71e3aafda0cd150710a5cb639698bcef786991a47f31db9a22d70458
MD5 hash:
c91808576033cf6c8af668456a059a98
SHA1 hash:
3d5107cae2e0d37b30606ed678d89aa63ba00327
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/042f3c8d-f51a-4404-822e-e85c6a74dcce/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments