MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
SHA3-384 hash: fbe7d52d592164273192d8a36c355cff9302378c0b2cc23c7ad45f12de24ec69ee821e3204a5062c9cafb8b5824003f0
SHA1 hash: 73d737b77a8fea41dad18dc6cdde0892b0dc9796
MD5 hash: 7d800ad9f415b03e6bb9a029fa57a3ec
humanhash: sodium-pluto-louisiana-mirror
File name:ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
Download: download sample
Signature njrat
Create hunting rule
File size:317'440 bytes
First seen:2021-09-22 13:23:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'651 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 6144:ajVd/ltsjnVfdLaDdndIXhsdaYLdRQcCLq57E1+:QPlez59aBdIRsvLdq9Lo
Threatray 419 similar samples on MalwareBazaar
TLSH T14A644A0EFEBA6C25C6AC4B7BC253645C41D7DEAEA211E2675DE439A01F312DDC88EC50
File icon (PE):PE icon
dhash icon 3f4d656563652727 (1 x njrat)
Reporter JAMESWT_WT
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
380
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
Verdict:
Suspicious activity
Analysis date:
2021-09-22 13:42:46 UTC
Tags:
rat njrat bladabindi
Link:
https://app.any.run/tasks/3ff0bc8c-eda2-4b50-a7f6-df278d91b311

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190284/
Detection(s):
Win.Packed.Bladabindi-6917466-0
Create hunting rule

Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6d7fd07e-ae02-45fd-8aa6-1dd7da88e835
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/855744
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 12:32:34 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vnn7w7defzm2tsfg6nzo4schx5olzercxkfeiwmzpz6nmtfzofcq._file
Verdict:
malicious
Similar samples:
256864d01e10f13f207b94efadddd3687aaa7f2a1ab29c8e9fe9a8ae8f524e1f
njrat
3d07e674b3ddbf25cefc72a2ec2e2bf08d450074e285dc89ef304903b6dbbce6
njrat
5576e6d2bde0df49ee885579d495ccacc2f3a21b45c512224f4180f96c0672b8
njrat
765b482b453872d5c03a3919057fac267ca22f85ff3b7fa3b2ea44c31b3a2604
njrat
bc568f10fe943dccb25ea6cd830cd4d54fbeef748e7da33bfac086f496c71bb2
njrat
bf84393caee9b769b516681ec8998afe26c22255c405ea9a027608ccf38ea36b
njrat
c4d1d6a9baaeb3802cfb9f7e21db83b85236844b62dc05f8ed4822e491703eb3
njrat
ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510
njrat
f089621fa865a1406a660945a8376953b51dee4e39b1d7cde0ca17b27a0ac7eb
njrat
+ 409 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion trojan
Link:
https://tria.ge/reports/210922-qned6afdcm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
8b85125361655289f5764d91a7ebce9aa983f912dd612deae1ec6d7ec62141f3
MD5 hash:
97c3ad2b3c6b9f7e1323365b2e35e238
SHA1 hash:
593e796828d76cac06b867d3a0ae93047009dbf3
Link:
https://www.unpac.me/results/966896fc-c68c-4c66-85ba-44ddc251eef4/
SH256 hash:
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145
MD5 hash:
7d800ad9f415b03e6bb9a029fa57a3ec
SHA1 hash:
73d737b77a8fea41dad18dc6cdde0892b0dc9796
Link:
https://www.unpac.me/results/966896fc-c68c-4c66-85ba-44ddc251eef4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190284/

Comments