MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb44653da2456706135577133cec5fa629cc2a5dc888f6d3f85acc5fe0f5632f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	cb44653da2456706135577133cec5fa629cc2a5dc888f6d3f85acc5fe0f5632f
SHA3-384 hash:	af0613200894f3332294058fe9507a8b64cee514616145caa03759f7232e043405f3dca58513e885f7c24f2ce07641aa
SHA1 hash:	7640175a8b9c04e939f16fe486d569e28d66acfc
MD5 hash:	f78560f01b09e27001cee35c23f0c239
humanhash:	fruit-asparagus-winter-item
File name:	f78560f01b09e27001cee35c23f0c239.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	259'072 bytes
First seen:	2021-05-05 13:22:56 UTC
Last seen:	2021-05-05 14:03:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	3072:ktms8zXlPm0W+vjPqS7uj/xr+VBFaI1YIYiheeeeeeeeefYDeOiClppeppOpplpL:H1W4jPqpZrMBgkSOG9iO2RK
Threatray	372 similar samples on MalwareBazaar
TLSH	F8444ACE735B99DBCA5505F03853C27C83339E6BE123E64A2CB167AED6B216713600D6
Reporter	abuse_ch
Tags:	exe NjRAT RAT

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Njrat

Link:

https://www.capesandbox.com/analysis/150628/

Detection(s):

SecuriteInfo.com.BackDoor.SpyBotNET.32.26999.2914.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

DNS request

Connection attempt

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cb44653da2456706135577133cec5fa629cc2a5dc888f6d3f85acc5fe0f5632f/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2021-04-20 03:43:50 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zncgkpncivtqme2vo4jtz3c7uyu4yks5zcepnu7yllgf7yhvmmxq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210505-9e33fzkg3x/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

cb44653da2456706135577133cec5fa629cc2a5dc888f6d3f85acc5fe0f5632f

MD5 hash:

f78560f01b09e27001cee35c23f0c239

SHA1 hash:

7640175a8b9c04e939f16fe486d569e28d66acfc

Link:

https://www.unpac.me/results/ed836ec9-a76e-4c2e-a3ee-534738c061a5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NJRat

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cb44653da2456706135577133cec5fa629cc2a5dc888f6d3f85acc5fe0f5632f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time