MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9
SHA3-384 hash: 40acc1cf990d79a3eba08653ab2c4b2746f2d4b8d85be02ecf2f38d0e89f0bd1b5706c6393822a49d25011e044044d67
SHA1 hash: 3201f6a99ce71f7c85c1be447d5465731bde792b
MD5 hash: bf64c61d86b3334d35e209f344ce96a6
humanhash: october-bluebird-oregon-nuts
File name:d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9
Download: download sample
Signature njrat
Create hunting rule
File size:538'112 bytes
First seen:2020-06-29 07:23:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:JnOF0nOF0nOF0nOF0nOF0nOF0nOF0nOF0nOF0nOF0nOF0nOFe:MHHHHHHHHHHHe
Threatray 49 similar samples on MalwareBazaar
TLSH C1B4A69A63987C21C37C67B54931D30987F2B68B18A3E78D0CC985EA0F377453D9B5A2
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15586/
Detection(s):
Win.Worm.Njrat-2
Create hunting rule

Win.Trojan.B-468
Create hunting rule

Win.Trojan.Bladabindi-6044420-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 02:08:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
48
AV detection:
29 of 30 (96.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=27oy5h6w34kkp7ql226adrctcblhnwyzgli4ezexuigejwm2o7uq._file
Verdict:
malicious
Similar samples:
08c0375aa494984e77ec6a082f10b27cf45f7ca08ad1bf2c4c7d4119d41a88af
njrat
2df8b942572700c36070d92e00830e2962f7c199c21d497df65a55e8248c2301
njrat
329b10943314d1e2013f44dcb3ad15ae390bc5d15cec294592c465075e77a5b7
njrat
61322bfef06e7fda9e84ad05a402f63f3ece7013120081ca2d3cdbfd4cfbc807
njrat
707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058
njrat
bccacb3d4d94bf0ffbe0b2ff26d4de7bdb0b400fbf88ad2894371c066a17480e
njrat
c0d2ceba24c17b069ad6198e0ec0e041e6a39115172d52126d414d5ec0b00487
njrat
c5d7176d2929750e2c3706f1cf41a356e7bf132ca4fcd994796e9f913b0a2fa3
njrat
ebda3d0f42a337880c4b2d262730986e20abcfda2b66f6d91f0ec82d5607552d
njrat
f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735
njrat
+ 39 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence evasion
Link:
https://tria.ge/reports/200629-h5f13q31ga/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RAT_njRat
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects njRAT
Reference:http://malwareconfig.com/stats/njRat
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15586/

Comments