MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f6fdc5e19242853318ccf433ca5288f4869fc045fde761b931a8bc8b8ac70d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f6fdc5e19242853318ccf433ca5288f4869fc045fde761b931a8bc8b8ac70d7
SHA3-384 hash: 8f22f7056ef39f07ef344370f30a198a1a479376073b097617116ecfade15707ddc9b6f238c87f7e2a06abd8824488e7
SHA1 hash: c1287a05d381069a06bcf716657ce1a38d9fd95e
MD5 hash: 0bcb7b5e42fc664c49a25df679fd3e62
humanhash: don-avocado-double-lima
File name:9f6fdc5e19242853318ccf433ca5288f4869fc045fde7.exe
Download: download sample
Signature njrat
Create hunting rule
File size:171'520 bytes
First seen:2021-09-06 22:11:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 960c1826fbf666b906a0c6637cfce460 (1 x njrat)
ssdeep 3072:JN4i+aojHzxSu2ORCyhg/WBqXWh1ZQDMAvP/1aKZxtX9hXvif/tRmSuq:b4iUnPg/hAQDV9/vif1u
Threatray 156 similar samples on MalwareBazaar
TLSH T1CCF3E403A7DE6FB5EC0228739147592F0C7A8DB1A62F44EBBFC65D5E8008682D26C757
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
62.33.159.162:5674

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
62.33.159.162:5674 https://threatfox.abuse.ch/ioc/216776/

Intelligence

File Origin
# of uploads :
1
# of downloads :
556
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9f6fdc5e19242853318ccf433ca5288f4869fc045fde7.exe
Verdict:
No threats detected
Analysis date:
2021-09-06 22:39:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ab9734e0-675c-405a-b717-97e2269d5e77

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185765/
Detection(s):
SecuriteInfo.com.generic.ml.27923.13974.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Creating a window
Connection attempt
Unauthorized injection to a system process
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3597b4e7-a0a7-4a16-9680-e8e8978d1b13
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/846174
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9f6fdc5e19242853318ccf433ca5288f4869fc045fde761b931a8bc8b8ac70d7/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 22:12:19 UTC
AV detection:
8 of 40 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5x5yxqzequfgmmmz5btzjjir5egt7ael7phmg4tdkf4rofmodlq._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
077a1514c1e8452cea89624a0f990a369fa2e654ce743b264fc9e3c85d7025e4
njrat
0e2821a2518ddfba5c461b6ebcd30d0226c92cfbf9bc31d1b848502dc0fb89df
njrat
62883e8f83fcbbfb535c5dbef62be7d671b3513540f15b8b1d293a5fc9ea79b1
njrat
6f8b5cad56d107434291b260c5483479d0ac1d02498d5bfad7468a02dc7fc19d
njrat
7dccbba3dd0e7a899a0cfc01bbf1d7625fcc06f1704be9231782cfc9bccc6b73
njrat
81e7f34b79771377a5826d74309f7ca00e1e8a4f42a79328836925ba55fdcd47
njrat
83456f70dec6de88075e8f81f212d4d0798f3dd42e37838c6d824cfd5bf2fa67
njrat
9da9406ecc1b6be6712d7bb120b957e5d7d3f7364e7018a6cba2bfb35ddd1830
njrat
9eb46ce54466b221c7f56d3af4c22be517472189d7e907ead1b4c3fa4cfeb831
njrat
e8ea3c240a7dc0081189f35e73a4f74ba329c1afd98d9153fc273569f14e3a80
njrat
+ 146 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat trojan
Link:
https://tria.ge/reports/210906-14l42sbee4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Suspicious use of NtCreateProcessExOtherParentProcess
njRAT/Bladabindi
Malware Config
C2 Extraction:
62.33.159.162:5674
Unpacked files
SH256 hash:
cee35e488fffbc922b8a2d885585e325a67ed0a0b36b9e4d8008d0125cff6e6a
MD5 hash:
3a29d04bf25d0bc951f13fbd957be075
SHA1 hash:
1a7bc5ddaab73538bb1f737faa2bc43ebaf608d0
Link:
https://www.unpac.me/results/b03d045b-22fd-467c-ae00-68b6dbd68798/
SH256 hash:
9f6fdc5e19242853318ccf433ca5288f4869fc045fde761b931a8bc8b8ac70d7
MD5 hash:
0bcb7b5e42fc664c49a25df679fd3e62
SHA1 hash:
c1287a05d381069a06bcf716657ce1a38d9fd95e
Link:
https://www.unpac.me/results/b03d045b-22fd-467c-ae00-68b6dbd68798/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9f6fdc5e1924/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f6fdc5e19242853318ccf433ca5288f4869fc045fde761b931a8bc8b8ac70d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185765/

Comments