MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ab3b273902918a617fca743185cdcae29f33be32324e761033038ce9d9ead60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ab3b273902918a617fca743185cdcae29f33be32324e761033038ce9d9ead60
SHA3-384 hash: fe05bf4ace334b21ecbcc0ee0809993d91d0804f0e633d9aa3c77dc10ed7d50e94087a231f7cd841e1fbab5e7130172b
SHA1 hash: dbd045ddf67f033ee17458804d236f43281446f9
MD5 hash: d6913ee05a5d880c9320ed7237914208
humanhash: magazine-echo-march-asparagus
File name:0ab3b273902918a617fca743185cdcae29f33be32324e761033038ce9d9ead60
Download: download sample
Signature njrat
Create hunting rule
File size:1'328'280 bytes
First seen:2020-06-10 11:40:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:4AHnh+eWsN3skA4RV1Hom2KXSmdabxrhteX+57:/h+ZkldoPKi2abxrHR7
Threatray 811 similar samples on MalwareBazaar
TLSH 72558C03739D9026FEAA927F5B55B20156BC7D2401E3872F12983D6DA9F03B11E3DE62
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 23:41:22 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkz3e44qfemkmf74u5brqxg4vyu7go7demsooyidga4m5hm6vvqa._file
Verdict:
malicious
Similar samples:
15d88e59e80b15ed7b24ffd1a496ff718b76a6a7d06cc2be0d1f91e460871c12
njrat
318d50e4155f24d6fb987eba93dbabb01b72d9f2d643bbf3dcef88e923bccff8
njrat
342c79ff62a16ad618c837f19efa7362a7f06403b5eb405ca667048d90344945
njrat
4f1d9a967da00fdf547491027d2a3d1fc60cd6b3ad216786505c1405e7a07f08
njrat
970ffc480d61b37737f34ddf738e257a99162cce8338f7c59fdd4ab995ae9dfc
njrat
b68cbb0343ba617a4dcfd72db74e093aca82eacf48aa4a5137d5eb180243092c
njrat
c0e957bd685417a90c9a53b926e2492a627b247357648d2a3857c6ce61630e20
njrat
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
njrat
f13513c8b2e9f663d86a33c0d86179aa25ae600b1fac25b79b7767b99be9b177
njrat
f8a0dc556cb32848df6c3887c226811f434d872d29b01a783631cd472edc2f8c
njrat
+ 801 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-38ftbr7r3s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments