MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f
SHA3-384 hash: 94a275ec326c8376bd7bf43b643e2595655440a008a54626afc941b880332300c318b22348010b95217300204e1b68f8
SHA1 hash: 27f1e1b199addfa25dc8aaf5b1b83361381cf322
MD5 hash: b5be0922744c9dafe464a01c468de91f
humanhash: iowa-arizona-alabama-mars
File name:c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f
Download: download sample
Signature njrat
Create hunting rule
File size:1'897'472 bytes
First seen:2020-06-29 07:11:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 49152:5hUKHkl6KTqiD90Qt8toqJJCsU0Uyd04vOANyjaV+no7ws6:5aakl6KTqiRCmmJCsUitYYws6
Threatray 48 similar samples on MalwareBazaar
TLSH 5295D55BF990AB36C02A2C73C4966D7D82D9C69F5F42D707B2A8072823523FDD39614B
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15489/
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c925d43deca61d344a00221f897dbe35175272a0984ffbba675194fe48842b3f/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 00:11:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zes5ippmuyotisqaeipys7n6gulve4vatbh7xothkgkp4seefm7q._file
Verdict:
unknown
Similar samples:
031b235aecbb9dd278dd748679c3103920a23a7f7eb5938b328346a7e45eece7
njrat
2a46e0846fb5b909da9df065c96a2c482075dac2d57bc5bc02d70954e9c7e7da
njrat
3027dc21e325fddbc9e6cd21b0491f3270190f219776de4971e510c4490d3c25
njrat
380f06e9a34d63f3b41e94cdb6781254e7582c811adaaf48855d4e945e8f96b0
njrat
6952d61c1b90bbe292626eddde290f0649ff02beca59738bf0912f6e1491538e
njrat
927f575e760758781d405edb7a7a16bd4a8069babb55a4bde1103f235fe0b602
njrat
a9297e27075d755670954bcffb05bc3dd60fde115a342c93a6e76ac9ff6b9494
njrat
c1dc52285b9b9c38bdcfd347559f64b0de7394a8f66714e3b9148216fc91a411
njrat
ea1e920b88c5129a91704c6075aa29e5e0f86240f64ad742497eefdbde4ea207
njrat
f1276162c44adfda7e0a2c65fa73515a29b0c56c4f0012273ac80114c01306f6
njrat
+ 38 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-1bjp4z1ctx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15489/

Comments