MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbf78b5fa17f5545ee34137874c4feaf707fa556256bc74bee80d58782cdd719. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbf78b5fa17f5545ee34137874c4feaf707fa556256bc74bee80d58782cdd719
SHA3-384 hash: 97d1752d77cedd0c051e30e0b7db6636e27397d1c659e3edb04925621650cee3934f80753a803a676bf32a1b2a918186
SHA1 hash: 4ec6feb309fffa4daa6da79ac5bfb54840caabe3
MD5 hash: 9b8683b6315bc51551b7eca42c3ae83a
humanhash: green-friend-emma-rugby
File name:bbf78b5fa17f5545ee34137874c4feaf707fa556256bc74bee80d58782cdd719
Download: download sample
Signature njrat
Create hunting rule
File size:1'220'096 bytes
First seen:2020-06-17 08:59:04 UTC
Last seen:2020-06-25 10:44:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c1d258acab237961164a925272293413 (5 x AgentTesla, 1 x njrat, 1 x SnakeKeylogger)
ssdeep 24576:qtb20pkaCqT5TBWgN0GTHhjU9tK+pDKywUYh6A:XVg5t0GTHhjU9t/vYh5
Threatray 982 similar samples on MalwareBazaar
TLSH 5E45AF2273DD8371C3B25273BA157B01AE7B786506B5F96B2F9C093DF820221521EA77
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19248/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 00:40:32 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
007ac20801e4bd954545cdcd275522fb87687179ed8dd160ceb6e906998a0558
njrat
0644b00b5884d167142693487ce70de79a73630bafceaa94f83e5e7051b63c2e
njrat
17fa709f1a866d573f997f8f1288d537de382cccc5a4f9c1811db9da34c016b2
njrat
1fdeff12a76654fa755bc975b5727280884ee49ce3881411b1769bbdc75688cf
njrat
47d82ba4710a3924c4c552d64568cc4e7384776ba1bbf1d84e2e9104a4e094a8
njrat
49921e6531eac85bf200970640a074072f6071b7a18d23af56706788cd421c1c
njrat
5fb6a70ea0d775ebd15b883fac32364c4eec52d595174fd99b966f089267da36
njrat
6b6c089ca78bae3ca6f4d42e4287f9e9303b271196eda028785d8c074c397f40
njrat
6fb3eca3bc35ceba9ce806f93a2855cec717897923851643f40e62dcecc2f14f
njrat
795f7fa0f7b342d1182983efaf179583c126f772ed1bcb634ea4b5468a9a6dfe
njrat
+ 972 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence evasion trojan family:njrat
Link:
https://tria.ge/reports/200624-bd7g6gmyw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19248/

Comments