MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8c178ffceaad0b87503d1045d2dc6f7fe431ed08b86a9a210b4b0325a401a8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 3 Comments

SHA256 hash: c8c178ffceaad0b87503d1045d2dc6f7fe431ed08b86a9a210b4b0325a401a8d
SHA3-384 hash: d818df4562f2ea18813b9ea0a977693b37eb3d75a46081c9da340691c723d643e82ab798b7c8d2d02333480c2a6914bc
SHA1 hash: 1498292fd549c6b32b9d6361ddd474a7997ea46c
MD5 hash: 83b20ab12a5ca0b41d5af87122007501
humanhash: mango-twelve-lake-papa
File name:EncryptSynaptics2.com
Download: download sample
Signature njrat
File size:53'760 bytes
First seen:2020-07-31 12:10:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 768:GUnOH4BCrXfdjVwYcExusXcwt3tRpcnuNitC3/dY:GUCfrPxrusXcwFtRWuNbFY
TLSH 73335C067E9C8132C6BC077445B64A440731D6975422FE2F7CC8658FBF77B980A1AAF5
Reporter @JAMESWT_MHT
Tags:NjRAT

Intelligence


File Origin
# of uploads :
1
# of downloads :
41
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
njRat
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Binary contains a suspicious time stamp
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Detected njRat
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Protects its processes via BreakOnTermination flag
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 255364 Sample: EncryptSynaptics2.com Startdate: 31/07/2020 Architecture: WINDOWS Score: 100 40 g.msn.com 2->40 42 bkhwa123.n-e.kr 2->42 44 asf-ris-prod-neurope.northeurope.cloudapp.azure.com 2->44 48 Malicious sample detected (through community Yara rule) 2->48 50 Detected njRat 2->50 52 Yara detected Njrat 2->52 54 8 other signatures 2->54 9 EncryptSynaptics2.exe 6 2->9         started        13 Server.exe 3 2->13         started        15 Server.exe 2 2->15         started        17 Server.exe 2 2->17         started        signatures3 process4 file5 34 C:\Users\user\AppData\Roaming\Server.exe, PE32 9->34 dropped 36 C:\Users\user\...ncryptSynaptics.com, PE32 9->36 dropped 38 C:\Users\user\...ncryptSynaptics2.exe.log, ASCII 9->38 dropped 64 Drops PE files with a suspicious file extension 9->64 19 Server.exe 5 5 9->19         started        24 EncryptSynaptics.com 1 9->24         started        signatures6 process7 dnsIp8 46 bkhwa123.n-e.kr 112.152.98.136, 467, 49723, 49724 POWERVIS-AS-KRLGPOWERCOMMKR Korea Republic of 19->46 32 C:\...\b9fecd2e0bb56b14271f159a0a82cae6.exe, PE32 19->32 dropped 56 Protects its processes via BreakOnTermination flag 19->56 58 Machine Learning detection for dropped file 19->58 60 Creates autostart registry keys with suspicious names 19->60 62 Drops PE files to the startup folder 19->62 26 netsh.exe 3 19->26         started        28 conhost.exe 24->28         started        file9 signatures10 process11 process12 30 conhost.exe 26->30         started       
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 12:12:06 UTC
AV detection:
25 of 31 (80.65%)
Threat level
  5/5
Result
Malware family:
njrat
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Threat name:
NJRat
Score:
1.00

Yara Signatures


Rule name:CN_disclosed_20180208_c
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:Njrat
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:win_njrat_w1
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments