MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735
SHA3-384 hash: face7016603c1d74ea43e9d60e3507dc11720ddbf6eca018272986752e352257ccd709be53d1e092a83613c0530cef1a
SHA1 hash: 5e5a25a16b7ccfc33d0d84b9393ea7e92667f48b
MD5 hash: d5b217cff72c79416299b6e7258cb905
humanhash: eleven-east-eleven-white
File name:f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735
Download: download sample
Signature njrat
Create hunting rule
File size:87'552 bytes
First seen:2020-06-29 07:47:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:brQKE0W7jOyxkUpvOpQyW6uCE8/v7bbitivs6TxvvSW4+LK/DA8U3aqrxxDlD65Z:vQKE0WPOmkfWtGnvmt+t9K5+F17wIU
Threatray 273 similar samples on MalwareBazaar
TLSH DC83088E23ED8D01F2FE9B754C316A0243B5E54B6B12D38E6EE185DD0FB7241CD81A66
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15933/
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Bladabindi-6044420-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Packed.Zusy-6917704-0
Create hunting rule

Win.Dropper.Bladabindi-7565286-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 18:48:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=626eaxnt3jhe35sugkoh6tw2376ahibt6kowiwwhq27qlyupk42q._file
Verdict:
malicious
Similar samples:
348ad616b802594ef5f77160bdf21fbe5b806e6400c2ad4cedc019bc25374e61
njrat
3d8567fb3b55c792b8ba70e2172726ae80805f1a1c858db29e13a5cd02d8634a
njrat
4468edc18de42e61b64441c75aedcb15d553410d473e77fc8ae31b358acd506a
njrat
85e0ff2f0c03b8d8ce1d32b446dcef0e32b79fa581a9c27dcf4d0bb92c6b167f
njrat
8893bec74478fc158448ae7d3bb01476c548b0b7db1710a5c7173ab6be099875
njrat
bccacb3d4d94bf0ffbe0b2ff26d4de7bdb0b400fbf88ad2894371c066a17480e
njrat
d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9
njrat
ebda3d0f42a337880c4b2d262730986e20abcfda2b66f6d91f0ec82d5607552d
njrat
f1909a39107c44c286a76d0f2169302c5afca80c6ef4ccc1e2c0d8a5410270b6
njrat
faf8184aa2a041106b6db4e567716ef5327df36371e5044b1c3818c1ac4d0466
njrat
+ 263 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence evasion
Link:
https://tria.ge/reports/200629-bvpexlq4gj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Drops startup file
Executes dropped EXE
Modifies Windows Firewall
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Winnti_Sample_May18_1
Create hunting rule
Author:Florian Roth
Description:Detects malware sample from Burning Umbrella report - Generic Winnti Rule
Reference:https://401trg.pw/burning-umbrella/
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15933/

Comments