MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eac957f655d15206f8875a31eb0b225040ee39015ff01189901f78230e39c33f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eac957f655d15206f8875a31eb0b225040ee39015ff01189901f78230e39c33f
SHA3-384 hash: 18d4e6a699aa4aeb3a06fd01fd1e0c426b03ce0619be3241048a587885715f444f43011743b38beed57638a4dbf9c35a
SHA1 hash: 419f797ffc20bf3f79910f52e2e1fa9d3679f1c3
MD5 hash: 2aca260a4efd8a20fbe8c32118857187
humanhash: gee-massachusetts-october-carbon
File name:eac957f655d15206f8875a31eb0b225040ee39015ff01189901f78230e39c33f
Download: download sample
Signature njrat
Create hunting rule
File size:211'456 bytes
First seen:2020-06-17 09:28:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:EYpDAlYgmBx7zuOxw64D46iWvAOYoxZRoZR9XIVktesBKVEijSQIU1iGa:EYleYV7zuuw64826ox6RxIWtesAmCm
Threatray 181 similar samples on MalwareBazaar
TLSH EB244A127BCAC621C5281A7180EBD23113B18F421773E75B3EC87F6F7EB26928A46755
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19368/
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 00:52:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
066752bd623ba4401c4f223b1d7d3367095632159cf758327e6fe7025d5d9a3c
njrat
2abe71b49e45492b408294a415a308799ed312ff79c013924a42e53ce9c32a82
njrat
59b230d608d121a6969fa2eab41b020c57f99328319ebd92ef00cb4081562589
njrat
618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7
njrat
632fad824e77666d3ccb676808a2f04eb349f1f0f1495e75b37aa47e690ffe14
njrat
82df2d9ba67f275874caca138baea0b54e90ffd727d561072243a9d9026569ae
njrat
95a191b5e1728a1dc9a0007719ae7adba5be88b1ae5e8919185c91a201148a51
njrat
b2f041348835c102db3769245ee4c28dd00cb19c3c6710fc9c11228f3bbce61b
njrat
f95573e18dd16600bedc2ab6917774a91603d5e90ae5deccfa969a8311802972
njrat
f9b03c723f0707c47dc00e0d77ac55559d2cd07cd6b38a67126e535068ca05dc
njrat
+ 171 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200624-7r8c1zb3b6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Modifies service
Adds Run entry to start application
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19368/

Comments