MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1
SHA3-384 hash: 63ae516c4a45ea32e47ac3d5363e119011eb20594a7e18c6dbe11a94b16c15fed09e473c27c328edb8651e341cac4c2c
SHA1 hash: 49c1773b7d162c52b805f7dd67c1547d7e58b0de
MD5 hash: d17d34d592b1c3d8e00992525a20b3d6
humanhash: pip-oven-friend-whiskey
File name:2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1
Download: download sample
Signature njrat
Create hunting rule
File size:93'184 bytes
First seen:2020-06-10 11:53:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:3YS8Knvtif3fT0qS3Pjxk0BBwIoiuRDOV7/rgKr4FctRWh9:3lzv8TUP9kkBeiiDOV7EdFoRWh9
Threatray 38 similar samples on MalwareBazaar
TLSH 5B936BDC37FACE73CA8DDB38906A03802B76D5147B43E7578AD4113E1DA2B962D45423
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.CryptoObfuscator
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 02:01:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=efyzi7elych5gibf3cb7azup535auq5ukgmisfzn6pn4l5p75diq._file
Verdict:
malicious
Similar samples:
16e2fadef5bcf0f418643eeefcfd53fb2bf6f51b1f1419b9e973a3a06f1d358c
njrat
3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
njrat
40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
njrat
439d5c2dcf14e2f1b24463094aafde50e9a5702e451a624c2078aa32acc194dd
njrat
5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0
njrat
73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd
njrat
7f8ce0eabde719c8e568ac741f48f0d9d931b3da8172b26e53af451ffcea1e10
njrat
a71aa1ff58118ec6ca9cd4cdb4daf51eed8484ed0dffabad893e30803e06c62f
njrat
ceaa237a1cecea60118cad22275777cfa4ff64ea121d317d7e32ab3df4e10412
njrat
e3a5edee75299a8ddfa254fda955173f9063ec8081ba03d946f82f996a3b0203
njrat
+ 28 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-6gll1g4gmn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments