MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
SHA3-384 hash: 93d534f514f28905488cbf12730fd48f0746be4c0c338149dee2da4781871e1af079682b125e19a9effc42c28d1bde36
SHA1 hash: f0ba23547b985524284b34993e6f650cf3fe48f7
MD5 hash: 3483079188b9a730fc255ac4d8c51f07
humanhash: fruit-oklahoma-pasta-oven
File name:3483079188b9a730fc255ac4d8c51f07.exe
Download: download sample
Signature njrat
Create hunting rule
File size:193'536 bytes
First seen:2024-02-03 20:15:16 UTC
Last seen:2024-02-03 22:23:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 492605aa7b8aefac51399cf6619dc6cf (1 x Smoke Loader, 1 x Rhadamanthys, 1 x njrat)
ssdeep 3072:xBfsGpcW25Gp+VIVnZM0NLsqHjHVcid1gOoVHFxq2YEOnB+llUhckPDfG:LsGckEKnZbDHVPgRUEOB+YJPzG
Threatray 686 similar samples on MalwareBazaar
TLSH T18114B511738CBDABE09906720099BDB41D75BFF32A5F855BB3DA6D0F9A14782323C50A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 13ccf096ccd44d07 (1 x njrat)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
46.246.4.20:3030

Intelligence

File Origin
# of uploads :
2
# of downloads :
418
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
njrat
Create hunting rule
ID:
1
File name:
f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe
Verdict:
Malicious activity
Analysis date:
2024-02-03 20:17:28 UTC
Tags:
rat njrat bladabindi remote
Link:
https://app.any.run/tasks/90b5c54c-e7ae-4256-9c1a-f75f28a79a47

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474421/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.34831.5592.11397.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
emotet
Link:
https://www.filescan.io/uploads/65be9f0519fc3809141e77bd/reports/6e40f939-e8d3-4e76-8b38-0b685f52db22/overview
Verdict:
Malicious
Labled as:
Emotet.Generic
Link:
https://www.hybrid-analysis.com/sample/f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/597f6bd6-fb76-4a9c-842c-4b5fbd97d42d
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1386182
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Drops PE files to the user root directory
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Snort IDS alert for network traffic
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1386182 Sample: CUwMwWqTFs.exe Startdate: 03/02/2024 Architecture: WINDOWS Score: 100 32 vinijr27.duckdns.org 2->32 34 Snort IDS alert for network traffic 2->34 36 Multi AV Scanner detection for domain / URL 2->36 38 Found malware configuration 2->38 42 11 other signatures 2->42 9 CUwMwWqTFs.exe 1 2 2->9         started        13 UnityStub.exe 2->13         started        15 UnityStub.exe 2->15         started        signatures3 40 Uses dynamic DNS services 32->40 process4 file5 28 C:\Users\Public\UnityStub.exe, PE32 9->28 dropped 44 Drops PE files to the user root directory 9->44 46 Writes to foreign memory regions 9->46 48 Maps a DLL or memory area into another process 9->48 17 RegAsm.exe 2 2 9->17         started        50 Multi AV Scanner detection for dropped file 13->50 52 Machine Learning detection for dropped file 13->52 20 RegAsm.exe 1 13->20         started        22 RegAsm.exe 15->22         started        signatures6 process7 dnsIp8 30 vinijr27.duckdns.org 46.246.4.20, 3030, 49736 PORTLANEwwwportlanecomSE Sweden 17->30 24 cmd.exe 1 17->24         started        process9 process10 26 conhost.exe 24->26         started       
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2024-01-31 02:22:00 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6faasr7wlrhuwz3qzklyo636no74s7po6zloecqgjzkc4lgtdv4q._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
041913272fd2e9e4bd0ae2f304c1ba7e87939b88f8c20dc00da7512f6f374f85
njrat
078a724f9a334f242ec580a1d6ec0f19f567ec778190e9eae0e312e7ec7156f2
njrat
44bd9d6a498ed0771813194e7a426f05f75ac96525518075c032bd74cc81a127
njrat
654553fbf3eb2b4d62f626efcd81da99001f87857c7efd8f49f8281459018c58
njrat
91b1b82d19155a4028599299e72779af33147ef437bbe72055550fe8315ce8db
njrat
9877fc613035d533feda6adc6848e183bf8c8660de3a34b1acd73c75e62e2823
njrat
9ac552edfd3efac284b13c278deb3c6341bbb391b02ed6b1db5ef427de656e36
njrat
+ 676 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat botnet:nyan cat persistence trojan
Link:
https://tria.ge/reports/240203-y14tksbfgp/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
njRAT/Bladabindi
Malware Config
C2 Extraction:
vinijr27.duckdns.org:3030
Unpacked files
SH256 hash:
3b55a0593cbcb87f9919ae8f73a670781d060c5de36ff02df6c219459bce5402
MD5 hash:
35a4e434ea45bb18712f13d330b1749c
SHA1 hash:
5530670e04ec1494f2d727c8a3877eaa8d7f6317
Link:
https://www.unpac.me/results/94d98cf1-779b-4aa1-a4d7-c2270ffdabc4/
SH256 hash:
f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
MD5 hash:
3483079188b9a730fc255ac4d8c51f07
SHA1 hash:
f0ba23547b985524284b34993e6f650cf3fe48f7
Link:
https://www.unpac.me/results/94d98cf1-779b-4aa1-a4d7-c2270ffdabc4/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f1400947f65c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474421/

Comments