MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8
SHA3-384 hash: c9ae326f9b17cdf08f4e8097fb0c6401ef5096c4291a6d034c879ca95e4732ae4942b615def11a53d481fef2777223a9
SHA1 hash: 884f78eed7337ca3305f175e4cdf30093465abc9
MD5 hash: 9058175e129983f1fa26192b92963427
humanhash: harry-football-chicken-california
File name:edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8
Download: download sample
Signature njrat
Create hunting rule
File size:3'162'112 bytes
First seen:2021-09-22 13:12:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:xh7FSWi4tvE3dMKUvlK00mL8lOiA+EAvhFe2r3UbTal/etmNnxz5Ki+:jxSoFE3bulbL8RA+EApFLr63tmbzQi
Threatray 943 similar samples on MalwareBazaar
TLSH T1D7E5331605CDFF13EC0A1732EFAEA00F6A22711F79DA05F911254BA7A79C6FB12C1A41
Reporter JAMESWT_WT
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8
Verdict:
Malicious activity
Analysis date:
2021-09-22 13:29:43 UTC
Tags:
rat njrat bladabindi
Link:
https://app.any.run/tasks/43425ac6-e20b-46d0-8c08-57464d24530b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190187/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6c254b4-4e54-45dc-a34e-ae4462d09710
Result
Threat name:
njRat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/855981
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Detected njRat
Detected unpacking (changes PE section rights)
Detected VMProtect packer
Drops PE files to the startup folder
Drops PE files with benign system names
Found malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 488412 Sample: uYteD4Q7W2 Startdate: 22/09/2021 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for dropped file 2->46 48 15 other signatures 2->48 8 uYteD4Q7W2.exe 1 5 2->8         started        12 svchost.exe 3 2->12         started        14 svchost.exe 2 2->14         started        16 9 other processes 2->16 process3 dnsIp4 34 C:\Users\user\AppData\Roaming\svchost.exe, PE32 8->34 dropped 36 C:\Users\user\AppData\...\uYteD4Q7W2.exe.log, ASCII 8->36 dropped 58 Detected unpacking (changes PE section rights) 8->58 60 Query firmware table information (likely to detect VMs) 8->60 62 Hides threads from debuggers 8->62 64 Drops PE files with benign system names 8->64 19 svchost.exe 2 5 8->19         started        66 Tries to detect sandboxes / dynamic malware analysis system (registry check) 12->66 38 127.0.0.1 unknown unknown 16->38 68 Changes security center settings (notifications, updates, antivirus, firewall) 16->68 24 MpCmdRun.exe 1 16->24         started        file5 signatures6 process7 dnsIp8 40 169.254.65.241 USDOSUS Reserved 19->40 32 C:\...\5694a017fe63401fb2064693504261b8.exe, PE32 19->32 dropped 50 Antivirus detection for dropped file 19->50 52 System process connects to network (likely due to code injection or exploit) 19->52 54 Multi AV Scanner detection for dropped file 19->54 56 11 other signatures 19->56 26 netsh.exe 1 3 19->26         started        28 conhost.exe 24->28         started        file9 signatures10 process11 process12 30 conhost.exe 26->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 01:53:00 UTC
AV detection:
24 of 45 (53.33%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0c73474ceb5c96ff4c0231b9d542d65c1d78b82de926bbfd4413d81684d78e58
njrat
25c212b01aed427cbe5c5e0f06e5edd0188f881551347aa20804b3da88da2af2
njrat
28f5fa7118d4f1866643d781c3fee5cb4507f3d268c263ef40551d527da2c330
njrat
554280d027e0ca9fac59307569a6352f04371cb55b35301b0a9432069ffc82c3
njrat
6a0d05477e23fc1152067fc51d50a044bccf0e0a0654dbae1864df792400e935
njrat
9ce97b2a248555831866151f6c4d9c682dc792f6df3e3e8f8142bdc717f34876
njrat
bff3d8677d0c866b3fa47a2176ba05c9ae03cc215794896f2ef922a1aa037097
njrat
c8b1c11bf16a1052dffb6942d955c31cdad7f0b154e1f855882d4d95359efa54
njrat
+ 933 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence themida trojan vmprotect
Link:
https://tria.ge/reports/210922-qf3rsafccn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Drops startup file
Loads dropped DLL
Themida packer
Executes dropped EXE
Modifies Windows Firewall
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/df07209d-f288-4331-8e08-277375db156b/
SH256 hash:
edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8
MD5 hash:
9058175e129983f1fa26192b92963427
SHA1 hash:
884f78eed7337ca3305f175e4cdf30093465abc9
Link:
https://www.unpac.me/results/df07209d-f288-4331-8e08-277375db156b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/edcf9ff78c1052de65460ccb3122af13229421ba933548e5de24cebd684d1aa8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MALWARE_Win_NjRAT
Create hunting rule
Author:ditekSHen
Description:Detects NjRAT / Bladabindi
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190187/

Comments