MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa19ac521abfc983ea04f49149a9aa011b57a0e3ff2b9b4120f32951d5783d33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa19ac521abfc983ea04f49149a9aa011b57a0e3ff2b9b4120f32951d5783d33
SHA3-384 hash: fe44e2e29285a6ca8858a9079c4fe3a4f750a0a1c3399bef6e2538abf2af6e5217e24c328c97e5996ba23be1dbad7d4b
SHA1 hash: 219fe2316249022011cf3a9476deb0e9e9220c13
MD5 hash: 7b561962d5f88a3d4dd20051e5a5420f
humanhash: west-saturn-alabama-arizona
File name:fa19ac521abfc983ea04f49149a9aa011b57a0e3ff2b9b4120f32951d5783d33
Download: download sample
Signature njrat
Create hunting rule
File size:72'192 bytes
First seen:2020-06-29 07:50:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:GAdR3tLoMWzTIl879gZ7wQYydguJcF4Qhc4VjsS8jdMUIDLTtgyfDeyD7g:ddRdLDWHIl87OZ7wQ/2hBjsVw5I
Threatray 232 similar samples on MalwareBazaar
TLSH 8563142629FB509DF3A39EB21FC9F8FF896AE677551D30B631410B068722E408D52736
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15979/
Detection(s):
Win.Dropper.Bladabindi-6871269-0
Create hunting rule

Win.Packed.Ursu-8015308-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa19ac521abfc983ea04f49149a9aa011b57a0e3ff2b9b4120f32951d5783d33/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 08:06:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7im2yuq2x7eyh2qe6siutknkaenvpihd74vzwqja6muvdvlyhuzq._file
Verdict:
malicious
Similar samples:
09c444de0cc6948127c49676f5ac857f9dcb358077e4f3e50204e0b1b08daa20
njrat
2d6359106c57e02d2a9364c02ee3657a894899e24b3273ee59095f925eae5500
njrat
4a70117a242a51045a243f7807d17724f5eac5f678e0ed477f4fd755261b37f7
njrat
6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6
njrat
68659662a735e14235e68e5edee17995b1443af662e6d789c5461c8733f4b3aa
njrat
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
njrat
99f851b8bb921318568a9c87ef39bc353c0e3c9af67a8f5078e957f4bb046491
njrat
a9d72d30334206ef9ee87e5a8a919956f521c625508a30b3b7bf94856a60d030
njrat
d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be
njrat
e56112ed497393090b03baf44149168efc79b7c777813630d946f540868ae790
njrat
+ 222 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-5sb3ygjqpn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15979/

Comments