MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 151c9749ebcb80a9044840b499d3ec969f2cd5679b59253c23883c70af486475. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 151c9749ebcb80a9044840b499d3ec969f2cd5679b59253c23883c70af486475
SHA3-384 hash: b140e395ff7e8ce3adf62bbe8a34bb47a19feedfca1a3d045d2d08b1fdbc4d3bcef93f3a1afbe2ef29e4bc479cd0ac4c
SHA1 hash: 6c15c335d4e385a375e8bf2a7011fdb04be17c49
MD5 hash: 1b1fc87b2cc10fdc18865cbe005ce97c
humanhash: thirteen-mexico-ten-bakerloo
File name:1b1fc87b2cc10fdc18865cbe005ce97c.exe
Download: download sample
Signature njrat
Create hunting rule
File size:394'040 bytes
First seen:2020-11-20 07:22:41 UTC
Last seen:2020-11-20 08:57:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'471 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:jjNhRL+wCZ9mUr09Qh7Z+erXdXFh9h77244SAdE04y8P5muR/wiVpz0787V:1rKwCTt09E++XdXFhisAaRR/wMR7V
Threatray 82 similar samples on MalwareBazaar
TLSH EF84F18691485743E5B82BB255F36A984727ADFEE1A3F37A704CB0B29B333C7415244B
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
NjRAT C2:
xcosgate.ddns.net:9243 (185.19.85.133)

Intelligence

File Origin
# of uploads :
2
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Creating a file in the mass storage device
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/541807
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 320002 Sample: IMAGE-18112020.exe Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 38 xcosgate.ddns.net 2->38 40 cdn.onenote.net 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for dropped file 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 10 other signatures 2->48 9 IMAGE-18112020.exe 1 6 2->9         started        13 vlc.exe 3 2->13         started        15 vlc.exe 2 2->15         started        signatures3 process4 file5 28 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 9->28 dropped 30 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 9->30 dropped 32 C:\Users\user\...\IMAGE-18112020.exe.log, ASCII 9->32 dropped 50 Injects a PE file into a foreign processes 9->50 17 IMAGE-18112020.exe 5 2 9->17         started        20 vlc.exe 13->20         started        22 vlc.exe 15->22         started        signatures6 process7 dnsIp8 34 xcosgate.ddns.net 194.5.97.17, 49735, 49742, 49743 DANILENKODE Netherlands 17->34 36 192.168.2.1 unknown unknown 17->36 24 netsh.exe 1 3 17->24         started        process9 process10 26 conhost.exe 24->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/151c9749ebcb80a9044840b499d3ec969f2cd5679b59253c23883c70af486475/
Threat name:
ByteCode-MSIL.Infostealer.Maslog
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 20:54:09 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuojosplzoaksbciic2jtu7ms2pszvlhtnmskpbdra6hbl2imr2q._file
Verdict:
suspicious
Similar samples:
394460b6c0b33b4e5d45308e968e765627fb9f34d4ad8c51b8922543d6bf2490
njrat
5dcd1649d97e0da882778ec70677be52b49603b6596b044518f02c278d93d0f2
njrat
6cb35d59850a6e43f2b6cfe1de03a41d81ab9bc07bfdb1b4b1f3cadba53d3086
njrat
6fb60c80bdc9cd558a384b468dc8b8467fb2e02764728e6a0ebc28ca865f31f6
njrat
76ff41be8f7f15dbb035fb27ad00cbd313d0d75745945b81642f10986fc83ffb
njrat
a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a
njrat
bc36fa2314f4e45645af22ca75887b7b627de4a65bfd1d274f18e7fc1975c8e4
njrat
cffb56dddf9b596328082781400f1b5a1d7a995719c78dbdcbe41b026c86010b
njrat
d0f1b190868c2b25c602e6eee551a39fe677678d6e7dc45eb304fa82a5760799
njrat
ecf592d2aed1d17b4c75e72a40edeb9b4396c8c9181cee7519ebe63bb7391870
njrat
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201120-wq7hfpmgtj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Modifies Windows Firewall
Unpacked files
SH256 hash:
151c9749ebcb80a9044840b499d3ec969f2cd5679b59253c23883c70af486475
MD5 hash:
1b1fc87b2cc10fdc18865cbe005ce97c
SHA1 hash:
6c15c335d4e385a375e8bf2a7011fdb04be17c49
Link:
https://www.unpac.me/results/6085428b-3b1d-4675-ad31-a3696a5dedfd/
SH256 hash:
72540c36def2bbfdfb980cc66d09c822b03d683658a847acc5f2b2b616c6c43e
MD5 hash:
96aee7739109fb3add8af581b88c1ea0
SHA1 hash:
2dc4fd158fe18270d5350602103e21987e911cb5
Link:
https://www.unpac.me/results/6085428b-3b1d-4675-ad31-a3696a5dedfd/
SH256 hash:
1d3913c1d3590cae8250a8629d67be4c0fa845861021ac63b023df884371dfe0
MD5 hash:
39b44ee90b47091ffb639140f7f75899
SHA1 hash:
a72999d2d784eb6ae2ac64953dfc0707e1d73c42
Link:
https://www.unpac.me/results/6085428b-3b1d-4675-ad31-a3696a5dedfd/
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Link:
https://www.unpac.me/results/6085428b-3b1d-4675-ad31-a3696a5dedfd/
SH256 hash:
8540a82d0b1db88de9f3a51a2be2ed6210d5c39c9c33f1bda3de09d9a54197f7
MD5 hash:
66749e3863665b2834d5d83e400910cd
SHA1 hash:
b8fb97730706b8989611a52de713b28758920d8a
Link:
https://www.unpac.me/results/6085428b-3b1d-4675-ad31-a3696a5dedfd/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments