MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0faf8b5efc3607b63be896bf45b2f6c8681f9d68b92cb16e80d427c0a7f64e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 16

Intelligence 16 IOCs YARA 10 File information Comments

SHA256 hash:	d0faf8b5efc3607b63be896bf45b2f6c8681f9d68b92cb16e80d427c0a7f64e9
SHA3-384 hash:	7d90305c6c8901bef99bad88fd1f8cce73994f1d314bfd1a9d5214757c81050f95d3d83f70b1726520cfd6a11fb9957c
SHA1 hash:	c99d01a621af952dcbb835f991783f0033f87360
MD5 hash:	81fca732d405caf0e38575342ca8b05e
humanhash:	friend-stairway-vermont-cat
File name:	bHFy.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	26'112 bytes
First seen:	2022-12-06 04:42:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'856 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep	384:NLhzkaJcPknNlxlehKNOYUikkdIVYlvM3iY2OzRLTm3yilqq6xNktVvZ:dK0cu3reOELGlvqisFmVvZ
Threatray	15 similar samples on MalwareBazaar
TLSH	T1BFC2295A3F908162C6EF2BB406B3DB1142B2E5435A17EB5F4CC884F65B777804981AEA
TrID	60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	pmelson
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

225

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

njrat

ID:

File name:

bHFy.exe

Verdict:

Malicious activity

Analysis date:

2022-12-06 04:43:17 UTC

Tags:

rat njrat bladabindi

Link:

https://app.any.run/tasks/d6979c27-9a22-4241-a31d-ceb1fc6bedea

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Njrat

Link:

https://www.capesandbox.com/analysis/343181/

Detection(s):

Win.Trojan.B-468

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Creating a window

Query of malicious DNS domain

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

cmd.exe greyware njrat packed rat

Link:

https://www.filescan.io/uploads/638ec858485d8463dc40c064/reports/95fa3937-268c-43ce-88f7-a386fd703321/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

njRAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a3d22ad2-aeb1-407e-bb7d-a1aa7aac0e80

Result

Threat name:

njRat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1128618

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Detected njRat

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Detection:

njrat

Link:

https://mwdb.cert.pl/sample/d0faf8b5efc3607b63be896bf45b2f6c8681f9d68b92cb16e80d427c0a7f64e9/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2022-12-06 04:43:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2d5prnppynqhwy56rfv7iwzpnsdid6owrojmwfxibvbhyct7mtuq._file

Verdict:

malicious

Label(s):

njrat

44ffe36dad598708138873097f1da36e949a8ef60f1f6402c494bb6391424c10

njrat

6c8f0805290d03ab8fe1d2e21eaf62b80ab8677c430272f23dea52de6e4d8998

njrat

93a924da3e0e9c7cd63fc756581678664aea34e2f4a79bb1c7440be38445c037

njrat

c708eac65294c5cbda70ff5cdea537d06b798f4400f90e53f5c8a14041e84aca

njrat

dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

njrat

e39d341d68706a30f3573e29f69c70109789546fafad1471c89c719a9d8f00c9

njrat

f4ddd638a56ab3607b2ecbc00fe2130c0ece91b6e1d5c816b60ae9038ff217ce

njrat

+ 5 additional samples on MalwareBazaar

Result

Malware family:

njrat

Score:

10/10

Tags:

family:njrat botnet:hacked trojan

Link:

https://tria.ge/reports/221206-fb83wshe23/

Behaviour

Suspicious use of AdjustPrivilegeToken

Legitimate hosting services abused for malware hosting/C2

njRAT/Bladabindi

Malware Config

C2 Extraction:

https://pastebin.com/raw/WKEdYjeM:7000

Unpacked files

SH256 hash:

d0faf8b5efc3607b63be896bf45b2f6c8681f9d68b92cb16e80d427c0a7f64e9

MD5 hash:

81fca732d405caf0e38575342ca8b05e

SHA1 hash:

c99d01a621af952dcbb835f991783f0033f87360

Link:

https://www.unpac.me/results/e9527993-96f6-423f-9305-2e497ec7209c/

Malware family:

njRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d0faf8b5efc3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/d0faf8b5efc3607b63be896bf45b2f6c8681f9d68b92cb16e80d427c0a7f64e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AsyncRat_Detection_Dec_2022 Create hunting rule
Author:	Potatech
Description:	AsyncRat

Rule name:	CN_disclosed_20180208_c Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	CN_disclosed_20180208_c_RID2E71 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://twitter.com/cyberintproject/status/961714165550342146

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables (downlaoders) containing URLs to raw contents of a paste

Rule name:	MALWARE_Win_NjRAT Create hunting rule
Author:	ditekSHen
Description:	Detects NjRAT / Bladabindi

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Unknown_Malware_Sample_Jul17_2 Create hunting rule
Author:	Florian Roth
Description:	Detects unknown malware sample with pastebin RAW URL
Reference:	https://goo.gl/iqH8CK

Rule name:	Unknown_Malware_Sample_Jul17_2_RID326D Create hunting rule
Author:	Florian Roth
Description:	Detects unknown malware sample with pastebin RAW URL
Reference:	https://goo.gl/iqH8CK