MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a09c15cbdf630ca762a9baa8cffd71fdeeb9195f1ed0bcf1aab4d46afdb13dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 6 File information Yara Comments

SHA256 hash: 2a09c15cbdf630ca762a9baa8cffd71fdeeb9195f1ed0bcf1aab4d46afdb13dc
SHA3-384 hash: 6f56280022f10d1052e8f5f8fe0012b2f8789f75e51f9cf9c62d37a54482fb644ce14e593a048de3a6f15ad9abef0784
SHA1 hash: 1848f72d0e23e721f3307a1ce2673f5d127b7032
MD5 hash: 3f4f53a5a18c6b737d649b011dd6b9a1
humanhash: avocado-summer-utah-alabama
File name:mat.vbs
Download: download sample
Signature njrat
File size:7'519 bytes
First seen:2020-07-31 13:37:09 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 96:lRhG5otGJ8U2NeNpkZC8KJC34yBBrvw1W5ZyvxFnewGjFkheoHSl5oTIp8TngwqL:NGRjAQJ+Dw1cyTew4FB60pqnsvT
TLSH 22F16E9D33C931F8C2D729A7287A09DFA0B218F975350715A778E5831B2BAD84D2BC51
Reporter @JAMESWT_MHT
Tags:NjRAT

Intelligence


File Origin
# of uploads :
1
# of downloads :
103
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Signature
Bypasses PowerShell execution policy
Creates processes via WMI
VBScript performs obfuscated calls to suspicious functions
Behaviour
Behavior Graph:
Threat name:
Script-PowerShell.Trojan.SAgent
Status:
Suspicious
First seen:
2020-07-31 13:39:05 UTC
AV detection:
7 of 31 (22.58%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Drops file in System32 directory
Adds Run key to start application
Adds Run key to start application
Blacklisted process makes network request
Blacklisted process makes network request
Process spawned unexpected child process
Process spawned unexpected child process
Threat name:
Trojan
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments