MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe
SHA3-384 hash: 53139a1a668d2b97a07ed27858b8a7ae1b2d47d69d1a35962eba9e582dd9c4e130445f77a99995e3d881d1ba6e64b5e4
SHA1 hash: 0674d3ee153e79b551fef19ed9b612691ae5019e
MD5 hash: c5dcc6be7d966c4ce26477c647b58cef
humanhash: yankee-sierra-ink-thirteen
File name:251642322342_Payment_Invoice_Receipt.vbs
Download: download sample
Signature njrat
Create hunting rule
File size:557 bytes
First seen:2021-12-04 14:44:36 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12:rVlZoY6aVXaAUzVE4wdMDJ5Y3nLjGTOb5NjyN9y4OIlC:rVln6aVX5U5EGDMLjywNGN9y+lC
Threatray 591 similar samples on MalwareBazaar
TLSH T1D7F05C299C04EACE0152EDDBC5D70C6FCD1580861A749525A172C2FE825A5CE90AE059
Reporter abuse_ch
Tags:NjRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
398
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/211323/
Detection(s):
SecuriteInfo.com.VBS.Agent.AHQ.11322.12886.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/61ab7ef14d8e6f3a5e0fc2c8/reports/c96f133b-fe53-46c5-aedc-39033be121db/overview
Result
Verdict:
SUSPICIOUS
Result
Threat name:
Nanocore njRat BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/901435
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Detected Nanocore Rat
Detected njRat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Obfuscated command line found
Protects its processes via BreakOnTermination flag
Sigma detected: NanoCore
Sigma detected: Suspicious PowerShell Command Line
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected BitRAT
Yara detected Nanocore RAT
Yara detected Njrat
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 533913 Sample: 251642322342_Payment_Invoic... Startdate: 04/12/2021 Architecture: WINDOWS Score: 100 50 nov20126746.duckdns.org 2->50 62 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->62 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 13 other signatures 2->68 10 wscript.exe 1 2->10         started        13 aspnet_regsql.exe 2->13         started        15 aspnet_regsql.exe 2->15         started        17 aspnet_regsql.exe 2->17         started        signatures3 process4 signatures5 76 VBScript performs obfuscated calls to suspicious functions 10->76 78 Wscript starts Powershell (via cmd or directly) 10->78 80 Obfuscated command line found 10->80 19 powershell.exe 14 20 10->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        process6 dnsIp7 52 transfer.sh 144.76.136.153, 443, 49756, 49763 HETZNER-ASDE Germany 19->52 54 192.168.2.1 unknown unknown 19->54 70 Creates an undocumented autostart registry key 19->70 72 Writes to foreign memory regions 19->72 74 Injects a PE file into a foreign processes 19->74 29 aspnet_regsql.exe 19->29         started        34 aspnet_regsql.exe 19->34         started        36 aspnet_regsql.exe 19->36         started        38 4 other processes 19->38 signatures8 process9 dnsIp10 56 legend4000.duckdns.org 192.3.121.222, 4000, 49785 AS-COLOCROSSINGUS United States 29->56 44 d3b888a1-9fc3-446f...a54f.up_meta (copy), PE32 29->44 dropped 46 C:\ProgramData\XXX\Microsoft.Exe, PE32 29->46 dropped 82 Protects its processes via BreakOnTermination flag 29->82 84 Creates an autostart registry key pointing to binary in C:\Windows 29->84 86 Uses netsh to modify the Windows network and firewall settings 29->86 88 Modifies the windows firewall 29->88 40 netsh.exe 29->40         started        58 nov20126746.duckdns.org 185.244.30.6, 49815, 49816, 49818 DAVID_CRAIGGG Netherlands 34->58 48 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 34->48 dropped 90 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->90 60 1120bitratnew.duckdns.org 185.244.30.13, 1120, 49834, 49836 DAVID_CRAIGGG Netherlands 36->60 92 Hides threads from debuggers 36->92 file11 signatures12 process13 process14 42 conhost.exe 40->42         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe/
Threat name:
Script-WScript.Trojan.Runner
Create hunting rule
Status:
Malicious
First seen:
2021-12-04 14:45:11 UTC
File Type:
Text (PowerShell)
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6yhxkquqtvor3eryxcdoieaf2u6kf4k7u36rfqfit73eeh5yh7a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
njrat
Create hunting rule
Similar samples:
2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0
njrat
3bf5f251905471ab07782554a58cfa444e4693c4b1ecad16471c489924fd1fe3
njrat
51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323
njrat
704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
njrat
84233aff74fa073271364dfebe6389ee18385f40747de4ffa5f437f90b3649a5
njrat
888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529
njrat
a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532
njrat
fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e
njrat
+ 581 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:nanocore family:njrat botnet:hacked evasion keylogger persistence spyware stealer suricata trojan upx
Link:
https://tria.ge/reports/211204-r4rj4abbfp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Blocklisted process makes network request
Modifies Windows Firewall
UPX packed file
BitRAT
BitRAT Payload
NanoCore
njRAT/Bladabindi
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
Malware Config
C2 Extraction:
nov20126746.duckdns.org:6746
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0fb07baa1484/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

Visual Basic Script (vbs) vbs 0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/211323/

Comments