MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7
SHA3-384 hash: 2a5a6758f5fc2f84323e4139ff7902e6a3dedca8c2af29bab42f73190b5ab9c01725975e41a682084679c9f78d62a80a
SHA1 hash: aea0108eb61ea5b416fc2beaf06b8f17f6b34826
MD5 hash: 811c4658c39a07fc3f36ce0e74b43805
humanhash: single-jig-vermont-white
File name:a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7
Download: download sample
Signature njrat
Create hunting rule
File size:511'325 bytes
First seen:2020-11-07 16:39:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (871 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 6144:TfQdkub0t90ny2RReqA8UBlYG2ugwq8cvTkBXUFUUNP6IQgqhJFuBr2QiI:UdHMH2veUklvLq8cvwBSPf0PGrP
TLSH B4B4BF01EB81EC77D1B265314E191F999B7535208E68672937F98ADF8F6C6402E20FE3
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Sending a UDP request
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Creating a file in the %AppData% directory
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Connection attempt
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 16:40:36 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3vp7ooz2j4l7t7auvwji5glu7azbtszekwslafay3adkkwcndtq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201108-bschz3n19n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
Unpacked files
SH256 hash:
a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7
MD5 hash:
811c4658c39a07fc3f36ce0e74b43805
SHA1 hash:
aea0108eb61ea5b416fc2beaf06b8f17f6b34826
Link:
https://www.unpac.me/results/99213c18-dd9f-42ad-ad33-d7b21a3a9e8c/
SH256 hash:
c0fcee4b170ba96c247d421497464563d5183fde2a86c5c92bdd0d1e935f7c9f
MD5 hash:
d2ba47b44742d40c11c4db08276c273c
SHA1 hash:
931e3f361a8a5c8f535594d98add0ed42dac0c40
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/99213c18-dd9f-42ad-ad33-d7b21a3a9e8c/
Parent samples :
090e9567b0be8d2dd04b2f10d103c920788c987d7ecee14aad28d2ec7c32a6f5
a6eaffb9d9d278bfcfe0a56c9474cba7c190ce5922ad2580a0c6c0352ac268e7
3b1e7e495d78f1b4a7fd801430e1e52c43c92b23c0641cee3065c75484e1da9b
b67556e2842e58862cd2591cc5624d2c27630301994c4c005ef3cab48ac7a8a0
fefdd2a90c1eda565689d37b29b0a36d479f18ef17a1c631eb021ccb9a62e8b7
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments