MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf67bb4f199395511b86a941b499edc0c34a4a3b12fc3161c0a5ef479f0b6601. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf67bb4f199395511b86a941b499edc0c34a4a3b12fc3161c0a5ef479f0b6601
SHA3-384 hash: a2b12bdb18b4bff93a619b73cf9dc63a02a621436d6b35069c003c4a1fe038c9c1cc628e1b5c7dee25ad3aaf66cd7751
SHA1 hash: e5781a223c13eabc480ccb48618407ae151a8425
MD5 hash: bbe65c87a400e3ae462bdf28ccd7bb5d
humanhash: batman-lake-fish-emma
File name:cf67bb4f199395511b86a941b499edc0c34a4a3b12fc3161c0a5ef479f0b6601
Download: download sample
Signature njrat
Create hunting rule
File size:130'048 bytes
First seen:2020-06-29 07:43:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 3072:cFH51SNoyO5HoJZotgcuDkmRw+R9RXE9qlbJcUo1lqi:c558t5rYdXmey9RXEgNJM
Threatray 572 similar samples on MalwareBazaar
TLSH C1D36DCB3AD57D94D8A849B65373A6C89635EE762D07F22E00D43B1F8E3B242FD06590
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15874/
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf67bb4f199395511b86a941b499edc0c34a4a3b12fc3161c0a5ef479f0b6601/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 00:10:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5t3wtyzsokvcg4gvfa3jgpnydbuusr3cl6dcyoauxxuphylmyaq._file
Verdict:
unknown
Similar samples:
276a602f80ffef482b3387d2d8e9f6b7b71db5344a5ad0d8a5514e3c5ee0948d
njrat
49bbc64881d66ec428ce3b2f670a2df89525391b1e608658c1d1b1758876d108
njrat
58066962925e1a45c26f64575be019e08c1e69bf200b4c8aeb34c8111b910325
njrat
6aaa864e402f7233d8682cb17f374e6dc6d70c9e73a943ba322df717af320aaf
njrat
aee8ac76d0269071bbb702bb59f37ad12f7a42844af9d9522fa39e49682c3be9
njrat
bedbcb43340c9c07dc601b696dfa3278df0c68ecfce2a4fd893a7b5e56a01de1
njrat
d09722da6fd4b8eb8ba3ee4d8e8a7ffe2cd396c410fa074bcb9fd0b44e399cb9
njrat
d6b038e51c9d5245b51ae42ee93438b54442b080644cb20e88c49c52f3ed3bb8
njrat
e33cc945d6b0681de6b34b52f0cb609676cdf5f3ecf61f4122b64d7a7e74b5ca
njrat
f2a9b8210e9545bf90468330a3afe70cbe26148b94658c49ff77cd59c733117b
njrat
+ 562 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-epw7xmy84a/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15874/

Comments