MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0eeb379c674f6caf454b18af219a5916889a33fddf5b7826c4d981a232d043d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	b0eeb379c674f6caf454b18af219a5916889a33fddf5b7826c4d981a232d043d
SHA3-384 hash:	3232bf55bd8e15961bcfcea8a78b29e0c27a8d61a7997310e8190d57ff89cef0c1d210b31ef80471be25abe252cf786e
SHA1 hash:	630ecb856a9f39ac05474761e55d894e5e23bb50
MD5 hash:	3091fae728e4aa53a3e78400f7e83f6c
humanhash:	bravo-fillet-hydrogen-mountain
File name:	VN7NZUNP.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	32'768 bytes
First seen:	2020-10-22 12:32:20 UTC
Last seen:	2020-10-22 22:28:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	384:c0bUe5XB4e0XnOfOliaXLilpknDzWTntTUFQqz94Obbz:JT9BuOpaXWlpKbz
Threatray	39 similar samples on MalwareBazaar
TLSH	E2E2F74677B58229C6BC5BF88CB313110772E3438432EB6F5CDC98CA5B67AD04255EEA
Reporter	pmelson
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Njrat

Link:

https://www.capesandbox.com/analysis/74642/

Detection(s):

Win.Packed.njRAT-7445143-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

DNS request

Using the Windows Management Instrumentation requests

Sending a TCP request to an infection source

Result

Threat name:

Njrat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/507096

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Detection:

njrat

Link:

https://mwdb.cert.pl/sample/b0eeb379c674f6caf454b18af219a5916889a33fddf5b7826c4d981a232d043d/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2020-10-22 12:34:04 UTC

AV detection:

28 of 29 (96.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wdxlg6ogot3mv5cuwgfpegnfsfuitiz73x23patmjwmbuiznaq6q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201022-v4tezz85ma/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

b0eeb379c674f6caf454b18af219a5916889a33fddf5b7826c4d981a232d043d

MD5 hash:

3091fae728e4aa53a3e78400f7e83f6c

SHA1 hash:

630ecb856a9f39ac05474761e55d894e5e23bb50

Link:

https://www.unpac.me/results/ef789989-7d11-47a6-994f-32253e318982/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.