MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008
SHA3-384 hash: 72041a15bdbbda1f6629ff12fc1dd515d46e0502d8bef8cc8fe9e5545ce48b95b2639844687ba917b768f14191140e89
SHA1 hash: befe3b799ff810d5ae3a0fc9334bc76bd802fdd5
MD5 hash: e419475aef86f5fd60955c438d46209d
humanhash: kitten-lima-michigan-bulldog
File name:e419475aef86f5fd60955c438d46209d
Download: download sample
Signature njrat
Create hunting rule
File size:175'616 bytes
First seen:2021-07-23 00:58:43 UTC
Last seen:2021-07-23 01:45:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:TNyvyOl4W8jh26hvMZgJ4rzHCn6+36fBU8jfxO6mZVE43HMrP+cvCitTtcpSaNma:RyvQhvst+aDPr2cqityS0mYd6F/G
Threatray 955 similar samples on MalwareBazaar
TLSH T171044FCB2D00A6FBC64EF93144A33B3C572B987E6BC79E0EE45B3D99573954D8A040A1
dhash icon 418e1729e0592300 (8 x njrat, 5 x AsyncRAT, 3 x CoinMiner)
Reporter zbetcheckin
Tags:32 exe NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e419475aef86f5fd60955c438d46209d
Verdict:
Malicious activity
Analysis date:
2021-07-23 00:59:21 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/731ccddb-6e12-44c3-8632-341d2d8299f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173465/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.32.12756.25104.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19967da9-281b-4d61-bbf1-d949efdd91b5
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/820479
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 00:59:04 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lg6ahs74qdaoltio7veul2jr2zez6u7myvhsj4bnczwwjuusaea._file
Verdict:
suspicious
Similar samples:
10c341f03698c730a4591d844c0d563f19e4a6b87934b45ff0447bd57808bb32
njrat
119d234e1f826adac6d68a614251fb9d1a20a4368102068ea030731372546f3c
njrat
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
njrat
35d8fbdb864d9104dd1a9f05fe522b27bb6d278ea993a7863b298b66df06636b
njrat
438b22a51b7bf77785d93d3ace1951b5b492e0b12e145178a24c5b80db9fb573
njrat
78421571ed40c04719354b6c325569c68109356a6f63ec038dd14060700e8b3a
njrat
bacd9f9cb9c0f2ac12f70b61102563449a2ca1de047567c66c6733395ce9200a
njrat
c3fd98f22e44b06271c6a46b217d59ba69b4bb181400d3fc1efe5cf9ca540a19
njrat
fc83ea48f38623db8af07e9dad3b2802bb49284ab2b69620eaf9a25f62177329
njrat
fca9c9be14541217929d625dd1efd04139b501d120a9a7a5b299fcd2a34973bf
njrat
+ 945 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata
Link:
https://tria.ge/reports/210723-nhfhr1sw7j/
Behaviour
Suspicious use of AdjustPrivilegeToken
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Unpacked files
SH256 hash:
facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008
MD5 hash:
e419475aef86f5fd60955c438d46209d
SHA1 hash:
befe3b799ff810d5ae3a0fc9334bc76bd802fdd5
Link:
https://www.unpac.me/results/7a5279d6-4f66-422d-8c9a-07f7df5d1763/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe facde01e5fe406072e6877ea4a2f498eb24cfa9f662a79278168b36b26949008

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1474763/
Cape
Cape
https://www.capesandbox.com/analysis/173465/

Comments


Avatar
zbet commented on 2021-07-23 00:58:44 UTC

url : hxxp://toobalhost.publicvm.com/91/OneDrive.exe