MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0
SHA3-384 hash: 337c3705a642ff2ac741f75893b5ebc48c576dc70b39afbf43ee8b8cdfaeeea3f81b88bbb60309f7d2cfccdaa56696ce
SHA1 hash: f415e9c1a072bdd44f54edabfe5c57f39f71fb0c
MD5 hash: d720ecdccd82525a211f09cfefcee6ee
humanhash: kansas-wyoming-speaker-texas
File name:V2N1M2_P.VBS
Download: download sample
Signature njrat
Create hunting rule
File size:556 bytes
First seen:2021-11-30 18:38:42 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12:rVlZoY6aVXaAUzVE4wdMDJ5Y3nLjGTOb5NjyNFpsy4OIlC:rVln6aVX5U5EGDMLjywNGNFpsy+lC
Threatray 587 similar samples on MalwareBazaar
TLSH T1CBF0A32ADC04AADE0142EDDBC0D70C6FCE1180871F74A5256671C2FF83575CE90AD05D
Reporter abuse_ch
Tags:NjRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/210051/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/61a66fcbc4c531414823bee8/reports/4dfa89c3-d446-4b04-aaf0-a56a288c9410/overview
Result
Verdict:
SUSPICIOUS
Result
Threat name:
Nanocore njRat BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/898971
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Detected Nanocore Rat
Detected njRat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Obfuscated command line found
Protects its processes via BreakOnTermination flag
Sigma detected: NanoCore
Sigma detected: Suspicious PowerShell Command Line
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected BitRAT
Yara detected Nanocore RAT
Yara detected Njrat
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 531447 Sample: V2N1M2_P.VBS Startdate: 30/11/2021 Architecture: WINDOWS Score: 100 48 nov20126746.duckdns.org 2->48 50 legend4000.duckdns.org 2->50 52 1120bitratnew.duckdns.org 2->52 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Sigma detected: NanoCore 2->68 70 11 other signatures 2->70 10 wscript.exe 1 2->10         started        13 jsc.exe 2->13         started        15 jsc.exe 2->15         started        17 jsc.exe 2->17         started        signatures3 process4 signatures5 78 VBScript performs obfuscated calls to suspicious functions 10->78 80 Wscript starts Powershell (via cmd or directly) 10->80 82 Obfuscated command line found 10->82 19 powershell.exe 14 20 10->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        process6 dnsIp7 54 transfer.sh 144.76.136.153, 443, 49753, 49755 HETZNER-ASDE Germany 19->54 72 Creates an undocumented autostart registry key 19->72 74 Writes to foreign memory regions 19->74 76 Injects a PE file into a foreign processes 19->76 29 jsc.exe 19->29         started        34 jsc.exe 19->34         started        36 jsc.exe 19->36         started        38 conhost.exe 19->38         started        signatures8 process9 dnsIp10 56 legend4000.duckdns.org 192.3.121.222, 4000, 49768, 49769 AS-COLOCROSSINGUS United States 29->56 58 192.168.2.1 unknown unknown 29->58 44 C:\ProgramData\XXX\Microsoft.Exe, PE32 29->44 dropped 84 Protects its processes via BreakOnTermination flag 29->84 86 Creates an autostart registry key pointing to binary in C:\Windows 29->86 88 Uses netsh to modify the Windows network and firewall settings 29->88 90 Modifies the windows firewall 29->90 40 netsh.exe 29->40         started        60 nov20126746.duckdns.org 185.244.30.6, 49787, 49794, 49829 DAVID_CRAIGGG Netherlands 34->60 46 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 34->46 dropped 92 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->92 62 1120bitratnew.duckdns.org 185.244.30.13, 1120, 49877, 49881 DAVID_CRAIGGG Netherlands 36->62 94 Hides threads from debuggers 36->94 file11 signatures12 process13 process14 42 conhost.exe 40->42         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0/
Threat name:
Script-WScript.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 17:57:28 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 45 (17.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsecazo25i6yhzgmvx2446apgo2xd3axtfur2a2vytc2bsmnvxaa._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
njrat
Create hunting rule
Similar samples:
3bf5f251905471ab07782554a58cfa444e4693c4b1ecad16471c489924fd1fe3
njrat
51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323
njrat
704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
njrat
888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529
njrat
a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532
njrat
ad29674b1a2bcc3ff4ef5746d9317740ab72b016ee3b89ac9aa9871bcb378b6b
njrat
d9f858f28cab427ea59133d06469903d937cd10334a0fdd5f77fe529e3d0ece1
njrat
fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e
njrat
+ 577 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:nanocore family:njrat botnet:hacked evasion keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/211130-xam8gabba9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Blocklisted process makes network request
Modifies Windows Firewall
UPX packed file
BitRAT
BitRAT Payload
NanoCore
njRAT/Bladabindi
Malware Config
C2 Extraction:
nov20126746.duckdns.org:6746
Malware family:
njRat
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2c882065daea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

Visual Basic Script (vbs) vbs 2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/210051/

Comments