MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
SHA3-384 hash: aed5bd03cfcef38dd20f91056482f27cf7c45acbc20cd8559ee38614c11c4de89fcbb78af2c643949650b6cbad7c77a7
SHA1 hash: fa3e84027a2f93b714ddec23ed668f2f5f37f4c6
MD5 hash: 27f650cf71924fc726b1bc6bb3c6fe9b
humanhash: eleven-glucose-three-violet
File name:d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
Download: download sample
Signature njrat
Create hunting rule
File size:91'136 bytes
First seen:2020-06-29 07:47:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 1536:+JQQLDFJvp4o927UbekwHTU3tTe/HoIFOmjPNvfZxfqxIFhZr:MQ6JX07UazzU3Be/II8mjl5+2br
Threatray 135 similar samples on MalwareBazaar
TLSH 7A933A56F79FEE6BC62E027780B145AD02359B030682E3BB78E92FE60D71BDD14426C5
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15924/
Detection(s):
Win.Packed.Hpbladabi-6860330-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f/
Threat name:
ByteCode-MSIL.Packed.Confuser
Create hunting rule
Status:
Malicious
First seen:
2020-06-27 01:31:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 31 (80.65%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qtzyrs2ksx3lmnj6mxyp5nskcgc4fzq27uy727nkjvpmpdn2jhq._file
Verdict:
unknown
Similar samples:
19f763b4199e2bee6affbd7a92bcd07f0234a3351a82a3df0e25ed48af1dc724
njrat
44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
njrat
4c247b8c2dd30ae28d1bb49828ae301e3f21e39d207258aa20f9e6ae3e56cc6d
njrat
84783081ade87f5a4a1902a275eb66c7fe8ebef9e43cdd2d4527bdb1a5a51f04
njrat
9edea7d68a48e54ec499302700e64a41a2cb38dab5d5d51c30c1ff2e40c393cf
njrat
ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc
njrat
c566031f2311f0c6769a2bd7280e2b58760ef3df4090b37e542f2f911cbc4f49
njrat
d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
njrat
dde1a479210f5225b0312ff6d155d870a094837a26338d594fb431134449aa16
njrat
fb3ca1866e216ffad74344e564be2f8aacabeb2c4616113d9fddf11561096bb6
njrat
+ 125 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
trojan family:njrat evasion persistence
Link:
https://tria.ge/reports/200629-fztrz7f2aa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15924/

Comments