MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dce19726be8dae788b32299c9bafc622d1fa36a0e5e46774d8c35e592ab12645. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dce19726be8dae788b32299c9bafc622d1fa36a0e5e46774d8c35e592ab12645
SHA3-384 hash: 02cb45f44569b764d513d9b6980d92f5f2eb8dc9a53f89596856646d7a5ead6899ddd64f1ab7f20a8eeb013961ee8fca
SHA1 hash: e67310bbfc026bae27d1a5766c2501e5d6bd912b
MD5 hash: 47755769bad603371a3f50577b35a134
humanhash: jersey-tennis-pip-two
File name:47755769_by_Libranalysis
Download: download sample
Signature njrat
Create hunting rule
File size:582'144 bytes
First seen:2021-05-10 12:01:18 UTC
Last seen:2021-05-10 12:57:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:9fVPsvqd+BOm0oQdg9ch8p22hUC531KfxLzo3TLgR81+t:9psvqd+BOmGdg9ch8p22hd5gxY3Am
Threatray 218 similar samples on MalwareBazaar
TLSH 6AC40685B346AFA6E1150FBA89130456D3F182275233FE4EBFEC6DE41500B8ECA5F691
Reporter Libranalysis
Tags:NjRAT


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
2
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/153972/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36871258.19235.29926.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Launching the process to change the firewall settings
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
njRat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/779390
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Detected njRat
Drops PE files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 411788 Sample: 47755769_by_Libranalysis Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 8 other signatures 2->47 8 47755769_by_Libranalysis.exe 15 4 2->8         started        12 AddInProcess32.exe 2 2->12         started        14 AddInProcess32.exe 1 2->14         started        16 AddInProcess32.exe 1 2->16         started        process3 file4 35 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 8->35 dropped 37 C:\Users\...\47755769_by_Libranalysis.exe.log, ASCII 8->37 dropped 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->57 18 AddInProcess32.exe 5 3 8->18         started        23 conhost.exe 12->23         started        25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        signatures5 process6 dnsIp7 39 194.5.98.210, 4040, 49720, 49721 DANILENKODE Netherlands 18->39 33 C:\...\0ef5de3f5b1fb89677ba03e41fa0a05a.exe, PE32 18->33 dropped 49 Creates autostart registry keys with suspicious names 18->49 51 Drops PE files to the startup folder 18->51 53 Uses netsh to modify the Windows network and firewall settings 18->53 55 Modifies the windows firewall 18->55 29 netsh.exe 1 3 18->29         started        file8 signatures9 process10 process11 31 conhost.exe 29->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dce19726be8dae788b32299c9bafc622d1fa36a0e5e46774d8c35e592ab12645/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-05-09 20:48:36 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0cbbdd2c9615f4d2de4e0232ace6b69889a54538444838ac6616a5aa39109c98
njrat
0ecfbf08398e1d0470c2f4d40a490808bd1b177cb60d674c5459d85f242952ab
njrat
4471de15ce9e9b3bee5bc77b26e67fe91b6be5e51d7ef8e174b30a6c3e32e43a
njrat
8e8b3b7c12c9e7113b882eb559fe9fd5cac868f8e3238942bcc9fa893521c5a4
njrat
955a5c96b1add7e062fe16492b630073f9aef9b50e10c9928d5510ebbe10f56f
njrat
9741ab464f2da0ec1effb39154615874073ccd368f77260b865c7fa7acd123b0
njrat
98e5d25243d03b80cc83c955796c42b39f308f55102a9ec01d0f308e06b4cfa9
njrat
af48d211d5bd97dbf5142304c87250f50244cc4b6649af0cd5e7fcc2193d03ed
njrat
cb5d45a2aff741e92a19428d7b5c5dbec63183e42035b190d732c3dd7d75918a
njrat
fb1efc79e627fcc4485b3bbde9d948f673172715a7fb165f373f79ba31671fb8
njrat
+ 208 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat agilenet evasion persistence trojan
Link:
https://tria.ge/reports/210510-89fgppp632/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/dce19726be8dae788b32299c9bafc622d1fa36a0e5e46774d8c35e592ab12645

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe dce19726be8dae788b32299c9bafc622d1fa36a0e5e46774d8c35e592ab12645

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/153972/
  
URLhaus
https://urlhaus.abuse.ch/url/1217766/
  
Delivery method
Distributed via web download

Comments