MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfb6b2b831592f1ebd43929977ae4963f8c2b3b2472214c82c3c3c1513a6b54f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfb6b2b831592f1ebd43929977ae4963f8c2b3b2472214c82c3c3c1513a6b54f
SHA3-384 hash: 2c419a3b1b972f66df3ad709aa31f417de419b3a23f93c177fa9e4893ab358b96b3dcb7d1c7ee6a917b49973f5ebb573
SHA1 hash: 120b12ffcf2f1510120bc22a10a54902200055d6
MD5 hash: a4b198cf7701e15ce121c72fd28ab4c0
humanhash: colorado-apart-mango-lamp
File name:cfb6b2b831592f1ebd43929977ae4963f8c2b3b2472214c82c3c3c1513a6b54f
Download: download sample
Signature njrat
Create hunting rule
File size:3'341'312 bytes
First seen:2020-06-29 07:09:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bc70c4fa605f17c85050b7c7b6d42e44 (15 x njrat, 12 x RedLineStealer, 10 x AgentTesla)
ssdeep 98304:4viz/27qWGq/TzuqCDl2Ptao7jg5lPNU:4viq75/Tzuf1LNU
Threatray 13 similar samples on MalwareBazaar
TLSH 73F5334076CC012BC9B113B114FD23971FB8BCB253759787A0C661CE199A491BAF7FA6
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15469/
Detection(s):
Win.Malware.Generic-6895514-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.MSIL.Krypt.11.1240.9175.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfb6b2b831592f1ebd43929977ae4963f8c2b3b2472214c82c3c3c1513a6b54f/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 04:23:31 UTC
File Type:
PE (Exe)
Extracted files:
765
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z63lfobrlexr5pkdskmxplsjmp4mfm5si4rbjsbmhq6bke5gwvhq._file
Verdict:
unknown
Similar samples:
1f02d06a14d5e83c297271a24f9dad9f28d25e387bc65784077ddc27165290b5
njrat
250cfc3bf5271e6a5cdd6ebe240865bf2f960c877590b679c878181b42f85341
njrat
548c375182f63e134625ec757d001e42051be39bf22f4065932ba53557825312
njrat
8d85f53634baffb8ccd9907595a253fff4542f33b158e8a57223c5ff51dfa1d3
njrat
ace64cbe1ef91a0b14602264fe0de8e3698cb8b901cbd6251b3fd11d87a0bef6
njrat
b0fedb5fc4232c07ff1161ddcc830cf11596ba2653cc7cea1d5666b4bab1f276
njrat
b2f041348835c102db3769245ee4c28dd00cb19c3c6710fc9c11228f3bbce61b
njrat
b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4
njrat
ccaedac7e0d5d4a655d37d59fb12bfb920785e9c8d0b811dc6ab88d3e1ca6ea0
njrat
fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763
njrat
+ 3 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence evasion trojan family:njrat
Link:
https://tria.ge/reports/200629-ftzjkw2dke/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15469/

Comments