MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 029afe41cf483d777bfa2608cf6b14d9b69faab8b09b94c693f609e78a996b58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 029afe41cf483d777bfa2608cf6b14d9b69faab8b09b94c693f609e78a996b58
SHA3-384 hash: c69cee9caecf391b6b6f0795b2abc25d19e73ff9f6e9c79b44a9af32ed187c5131594d3d64511ad5f9707026b3f9660d
SHA1 hash: e71a46c94eb37a39536e3a7f21437eba9ae96cc4
MD5 hash: d8cc418407e935e12d2c86a3ea66ab32
humanhash: vegan-single-fanta-papa
File name:029afe41cf483d777bfa2608cf6b14d9b69faab8b09b94c693f609e78a996b58
Download: download sample
Signature njrat
Create hunting rule
File size:74'240 bytes
First seen:2020-06-16 09:43:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:f3CWC7ddAWFt8+H5mioNe/3KiJkXC923fTvgrSCEJkaCmijBm2:vVCZdAG845mdN43li4k0r/Em7jB/
Threatray 36 similar samples on MalwareBazaar
TLSH 427322382EEA103AF177AF3DCAE035969A6EBAE73707586D10B102C64713942DDD163D
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10863/
Detection(s):
Win.Packed.Generic-7993330-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2016-07-11 00:39:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d
njrat
10cf748693a03e95d4f2efab81757ec3ad3905129e84b7dc8c491d9e5fbb550e
njrat
36abbef320573be77f282a10faa2413d38710d336ab7c61eb31a8f0ee572f6f6
njrat
40e95520d719a9c3277c76b42124de197dc391210b1053fa505897838dcdcb90
njrat
939863edcaf7c655fb6e3020bdfe5138bf6e61faa3d3b037f113216ccc1be55a
njrat
99ebd29c10ab0e9063fbec9966f1be56986d6c74630fb251baab26988aec93cd
njrat
d7c3ac66b3977de751a25e482bffb7eabaee20c623c529f479e07ac6234142d6
njrat
e65953c2d6e33c5da860ceac22ef685533e9b43bb3986e8e136eec82a5f5e547
njrat
f2c4b98fdadf7b1fec173ed6493daaaf1dbb13d8d659a73d9a6b494f32a750fb
njrat
f67653642f6bf485f584df4fbd546966e16fe413a2d152014dac2b586a656397
njrat
+ 26 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
trojan family:njrat evasion persistence
Link:
https://tria.ge/reports/200624-w1s3pxajfa/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Drops startup file
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10863/

Comments