MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cae26d8328441aecdf2312d0adbd867739739b0d5be786f1911f1b13c80bf7a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cae26d8328441aecdf2312d0adbd867739739b0d5be786f1911f1b13c80bf7a6
SHA3-384 hash: 97bd7a68b6ff089850c0ffee8a80accf05a38cb65bf21cbf30e5830de4e3d54056d940ec1e3759e767bd3b4e793ce028
SHA1 hash: 2c890a5af2cb15a2916d2d9bee5c4ed1eaf3aaab
MD5 hash: 7bb3434296afaafbbfc92fbce292a530
humanhash: helium-three-blossom-berlin
File name:7BB3434296AFAAFBBFC92FBCE292A530.exe
Download: download sample
Signature njrat
Create hunting rule
File size:36'002'944 bytes
First seen:2021-11-10 02:10:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 49152:+z/5HEYz5GI+WaW5TLGS+V+Tc6rsqhPoDjU4lnZeISRjZlpa2/1FSXZllL7CdA7g:+z/5kYdGNDI3+0l4qh8hlnwl
Threatray 11 similar samples on MalwareBazaar
TLSH T12287124546228EECE5A90DBC2CB91EC91BE83D723D65EDF19D3720430E616E520A7D2F
File icon (PE):PE icon
dhash icon 71f0969696d4f030 (2 x njrat)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
91.109.190.12:5050

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.109.190.12:5050 https://threatfox.abuse.ch/ioc/246308/

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi obfuscated overlay packed
Link:
https://www.filescan.io/uploads/618b2a37175442ca93a9f372/reports/d29eeed4-1fa8-457e-867d-5b99eba81efc/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/886404
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-11-07 03:19:00 UTC
AV detection:
12 of 27 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlrg3aziiqnozxzdclik3pmgo44xhgynlptyn4mrd4nrhsal66ta._file
Verdict:
unknown
Similar samples:
4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9
njrat
76ef13eeddb4b7717d5ec1d737b62c07dce1338cfb32fdf6c363d1fa189173ad
njrat
7bcfa2772341f0f169ee65c52cacae795e37e5107473f26301206f38f4622263
njrat
c7cfd6eb7f84680ea18209845e54a70e7ab07accdf94a9ef5b7399a9181af92f
njrat
c8c205bdf3a94934d337f9548ee63fe504f6fec787f881ed0c344e01fddb1b22
njrat
cf2519d7f487f8a64920eedf7446c626e41d6c0b8e7e8954f09214e12bbc7385
njrat
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata
Link:
https://tria.ge/reports/211110-cmaspadcbk/
Behaviour
Suspicious use of AdjustPrivilegeToken
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/cae26d8328441aecdf2312d0adbd867739739b0d5be786f1911f1b13c80bf7a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments