MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
SHA3-384 hash: 274747b91f4c26f05ea01476c2aeedbcfa7989c737226c25baa274ff095a604a627392a059b02795fc62e4154c525651
SHA1 hash: 8042ef490116bcfbabb392851f1936b54b7e7250
MD5 hash: 55005a36029461ea2bf49183b4dcbf49
humanhash: gee-solar-hotel-jupiter
File name:d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
Download: download sample
Signature njrat
Create hunting rule
File size:74'752 bytes
First seen:2020-06-29 07:49:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 1536:O0eUzOs4NwDNo2io5Cw/4sJ+MlSdRSD1ZipNocFiUOvw:O0eUzfDNoBs/4c7CRSDv8U5
Threatray 1'106 similar samples on MalwareBazaar
TLSH FD736C46FB9BDD4BC62E02BB81B142690132E9031686E377B9ED6FD70876BEC15425C2
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15952/
Detection(s):
Win.Packed.Hpbladabi-6860330-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2016-09-09 21:41:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tqe4puz5yxe76plwqpnd2grtyoq6wpss7yo63tssrvnizxlqy6q._file
Verdict:
unknown
Similar samples:
19f763b4199e2bee6affbd7a92bcd07f0234a3351a82a3df0e25ed48af1dc724
njrat
44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
njrat
6829cb62da82005be89a9f27b85c50a40f9a7a74424bf96500d420e077b8b666
njrat
750f91ca352c144b90bb159998a94f8a2dcb80a8463161217b921d720264c60a
njrat
923afe739adc8482ff3c6854a893e67ba74241aba874da9235765b862cf84977
njrat
9edea7d68a48e54ec499302700e64a41a2cb38dab5d5d51c30c1ff2e40c393cf
njrat
aeb35fd257a06bac1292f898a40223bc3e834b375b0314731fca930155b7d4e8
njrat
c4aeb26dbf763871a003bea68d96b7d6937437cfda61f18c36d1a72aa59667ac
njrat
d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
njrat
fb3ca1866e216ffad74344e564be2f8aacabeb2c4616113d9fddf11561096bb6
njrat
+ 1'096 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
trojan family:njrat evasion persistence
Link:
https://tria.ge/reports/200629-z7n62yvcjs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15952/

Comments