MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00be6a9b9b91b94bc066569c28c53683c5e7d617e4d5d60b422c607f5e3cba73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00be6a9b9b91b94bc066569c28c53683c5e7d617e4d5d60b422c607f5e3cba73
SHA3-384 hash: f4995b06f63df33466cdb734e7ba7b473fecf1363cb4a0ae8fa8ef27c2e06d7e60106286c1e9a74cdd5b2ffba7e9dcd0
SHA1 hash: b38f172dd19182e8ed2ab9f6f2588b1881f58b57
MD5 hash: dd357917bc3f69137a05c93b7e6ecc61
humanhash: quiet-don-avocado-ten
File name:KelleyBeanCL746713-6231150.cab
Download: download sample
Signature njrat
Create hunting rule
File size:496'688 bytes
First seen:2021-03-25 08:01:31 UTC
Last seen:2021-03-25 10:14:02 UTC
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:sm8+6kDUwTZObCpokNS/1mpindAPXhy7g46vZlohZdmJpB:smakDUPCO1mQWPXhycvZlohZgJP
TLSH 71B4236EA3AE181BCE0E8D398798A1776F528BD848395C3054BF2C73D6556426FF34C4
Reporter _Clevero
Tags:kryptik rar


Avatar
_Clevero
Sending IP: 80.211.198.27
Sender FROM: "John Bartsch" <jbartsch@brovteplo.com.ua>
Sender SMTP: jbartsch@brovteplo.com.ua
Subject: KelleyBean/Machine Request2021/679/USA

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Inject.gen.19060.10724.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00be6a9b9b91b94bc066569c28c53683c5e7d617e4d5d60b422c607f5e3cba73/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-25 08:02:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ac7gvg43sg4uxqdgk2ocrrjwqpc6pvqx4tk5mc2cfrqh6xr4xjzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/00be6a9b9b91b94bc066569c28c53683c5e7d617e4d5d60b422c607f5e3cba73

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

cab 00be6a9b9b91b94bc066569c28c53683c5e7d617e4d5d60b422c607f5e3cba73

(this sample)

njrat

Executable exe 4d244896566a6b93fd466c6d9e1d60df1fe555d95aa2df69f3f05fd671046bd0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d244896566a6b93fd466c6d9e1d60df1fe555d95aa2df69f3f05fd671046bd0
  
Dropping
MD5 8955ed56f2c51937f30068d570d8638f

Comments