MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 383fd4644bf15594d79bf2ca051f67e1bbbfa88efa8f611a3b847eb37422a60d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 383fd4644bf15594d79bf2ca051f67e1bbbfa88efa8f611a3b847eb37422a60d
SHA3-384 hash: a85c0db13d106f4c2cea40af2ddae419c77ca3b38062cc859e70b09ca751bca6c558872c591a8c372dce64493a7e9150
SHA1 hash: 57f14f11fcae3208b439ea7575e772679ef0e808
MD5 hash: 70883c2d07a91a15855baf378b2652b1
humanhash: social-uranus-connecticut-mobile
File name:Ningbo_P.R.China_Quote2020_DiscountOrder444996.rar
Download: download sample
Signature njrat
Create hunting rule
File size:202'847 bytes
First seen:2020-04-11 11:30:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:5VqWvX53z2eVLBeu2hfLnCBM/xxgWkeEu:LfvNz2eVV2hfuBQDlDEu
TLSH C81412918E132AD5D78107ED3D9E9AACA3AC8D61DA4B6931BCDC9A46F0C71F40BC0C35
Reporter abuse_ch
Tags:COVID-19 NjRAT rar RAT


Avatar
abuse_ch
COVID-19 themed malspam distributing njRAT:

HELO: alhoutisons.com
Sending IP: 62.215.26.86
From: "DEGSON-Jerry" <degson222@alhoutisons.com>
Subject: RE: Re: Re:( EMAIL ref. 767/19)/COVID-19/Order 20% discount
Attachment: Ningbo_P.R.China_Quote2020_DiscountOrder444996.rar (contains "Ningbo_P.R.China_Quote2020_DiscountOrder444996.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-11 11:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
12 of 45 (26.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ha75izcl6fkzjv436lfakh3h4g537keo7khwcgr3qr7lg5bcuygq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

rar 383fd4644bf15594d79bf2ca051f67e1bbbfa88efa8f611a3b847eb37422a60d

(this sample)

njrat

Executable exe 55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f

  
Dropping
MD5 e9b90f994d4c72b27ce7077838f0aa3b
  
Dropping
SHA256 55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f
  
Dropping
njRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f

Comments