MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e95ca33ca812ba4b79e965a53cd9d75d761baa830078dce5afc03147f038e87c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e95ca33ca812ba4b79e965a53cd9d75d761baa830078dce5afc03147f038e87c
SHA3-384 hash: e23b298be8a77a732843913923bcfbc57968537e3d95532d34d4135e9deea2abd8b0c59187f2fb3c11d0d377bb000ee8
SHA1 hash: c592d31bf122b3d10a2051204c14aee1a93c178d
MD5 hash: 533680ed01ec63e062a2ca6e4ff55b57
humanhash: idaho-enemy-angel-finch
File name:e95ca33ca812ba4b79e965a53cd9d75d761baa830078dce5afc03147f038e87c
Download: download sample
Signature njrat
Create hunting rule
File size:126'976 bytes
First seen:2020-06-29 07:43:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:S25dZ2a9ObCMPtWRR1L+pf5NDeNoE2LTkxOr7RxtBR:S2DEGRdqpf5YgLTgYbtB
Threatray 401 similar samples on MalwareBazaar
TLSH 48C37DBEE7BBEF12D24E063B50A6822D45B1D9121643EB7A3DDC3FEA1D317991502381
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15876/
Detection(s):
Win.Packed.Razy-8304058-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e95ca33ca812ba4b79e965a53cd9d75d761baa830078dce5afc03147f038e87c/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:20:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5fokgpfick5ew6pjmwstzwoxlv3bxkudab4nzznpyayup4by5b6a._file
Verdict:
malicious
Similar samples:
19f763b4199e2bee6affbd7a92bcd07f0234a3351a82a3df0e25ed48af1dc724
njrat
270c10b611fa95a41054622c5caed5e88a7b3ec9c2ffaec93725b95b6d6d5aa3
njrat
2a46d6c287851041f7a352051cadd95de3379b8878191c925f7d423a475936e6
njrat
32031ca4487b08af41a597da7d22c05a3d4f676c33119c057f3f4a1431217887
njrat
3c6d1adb8c659c6608e4fa44fe880adb352bd9e8491430b4f559604fd412e181
njrat
4bf2f4dd9ecaa28ecebae186a118cf66f8fce7ee8790351ca7224516ff47010e
njrat
504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
njrat
7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8
njrat
c58594d414c882ce33499233c2f508789e5fa4d91b79ef01d763012e39d7b095
njrat
e7e5f0ac865dd8cec6539a3defbd09f15df7822b647fcd2e2f53555be98ad8e2
njrat
+ 391 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200629-95gmn1l22e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15876/

Comments