MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb7f24f9a1bd015c84d6b703ff5f80799784201879459f1aaa1538f212a3c0b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb7f24f9a1bd015c84d6b703ff5f80799784201879459f1aaa1538f212a3c0b4
SHA3-384 hash: 0b89159ebb3c85921a3ff39237958e247f760c212ac5eb4ce1b00170cafe83751b287e297662dd76b11b3ed170b93710
SHA1 hash: 1eb5a1db6ce7560d5d8bc950f9575362312cff5d
MD5 hash: e25f2b8db012aa9b6f697b0273d1b897
humanhash: arizona-salami-montana-pizza
File name:eb7f24f9a1bd015c84d6b703ff5f80799784201879459f1aaa1538f212a3c0b4
Download: download sample
Signature njrat
Create hunting rule
File size:42'496 bytes
First seen:2020-06-29 07:52:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 384:T/iHXCVJmqpNwJrwajELSi/0NIB7JBm3Em5FUNRZK/LI00AyT062c4EF2RNz+lqw:T/mq8/RAIIsEiI04T0Y721P9ebe
Threatray 18 similar samples on MalwareBazaar
TLSH 1813C4C77BE54441C2CDB736845E0189513082273A829B9EACA5797E1E727DFB60CEE3
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16004/
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Win.Packed.Bladabindi-6900430-0
Create hunting rule

Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eb7f24f9a1bd015c84d6b703ff5f80799784201879459f1aaa1538f212a3c0b4/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 21:42:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5n7sj6nbxuavzbgww4b76x4apglyiiaypfcz6gvkcu4peevdyc2a._file
Verdict:
malicious
Similar samples:
129aefff5a7c2da45e7c0afe8bfbe3a16c437328ee569640d0c90a7c91de0dd7
njrat
16e2fadef5bcf0f418643eeefcfd53fb2bf6f51b1f1419b9e973a3a06f1d358c
njrat
39ca86089dcbdbce612bb989dda90c7fd5ab244f7b4b03b28e16124365ba858a
njrat
3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
njrat
40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
njrat
68489df213a73f1422b497da630067e152d62516ac535d87a8235e66dc8706cf
njrat
a1d9d1784959597859b70af8479ecb3a5eb577be1bcf10dc2b57fd7beb3ba874
njrat
a71aa1ff58118ec6ca9cd4cdb4daf51eed8484ed0dffabad893e30803e06c62f
njrat
c380f48e3d649b6a44b05134108a8c79536f289240e9ed9135e35dadffb6c350
njrat
f4d129a8289b89a4a8d385d89702bae3c7b5fcf9d32c3b1eee61bc0245bfb99a
njrat
+ 8 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-npm2vpcfqn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/16004/

Comments