MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
SHA3-384 hash: 92edce7c3580076f8892ce9cfd57d9e71d2fef2422880a33c5949405344260e5794fd082282c5da414d6e73fb068dc56
SHA1 hash: fffd25284f6f82c5d35c3c0ba18d16387146fb27
MD5 hash: 9491acdcb5fe083f2a2ce506432793fa
humanhash: winter-november-bluebird-lion
File name:448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
Download: download sample
Signature njrat
Create hunting rule
File size:79'360 bytes
First seen:2020-06-29 07:47:38 UTC
Last seen:2020-06-29 08:42:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:qwt0QrnNjzzea8kcmopA2VSIxgJFsuZQHId:qwaQrn1zea8kcmqVxmsg
Threatray 452 similar samples on MalwareBazaar
TLSH 657397153CBB001DF276CAF26DEBF9C69E69EAF6D9093C86E00453478912E019D53E36
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15936/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader18.42138.24560.18159.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2016-01-17 15:06:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=isgdnsrvi32eitnifzuitgameg7w6feomri2tt5zf3dakr5wyqnq._file
Verdict:
malicious
Similar samples:
10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc
njrat
524801975f071dc8562339fe68bc0094c94b0e4bfb936e4c4f7c0bf572f1720d
njrat
65878cef4e2fdd03c3c08a4070105ebe37c0c0f311679a0c21208ac9f8f7c069
njrat
668ec5b9759f0349cc79113c4d2bb62ebf2239de79532f97248b242df8608a3c
njrat
72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
njrat
76b18141d1602d474d2c3e2640b4e680867ab5e252eefed41439bf0056c9f989
njrat
a5aa97dcff50a939d85c1f2446dcc4122fdd5bf83aa2c10f9ba83a457575f615
njrat
b0fedb5fc4232c07ff1161ddcc830cf11596ba2653cc7cea1d5666b4bab1f276
njrat
bb301ca8c6b4567553fd8d0b7ddb4425109f5cb865bc209569a156260f72f6c7
njrat
e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13
njrat
+ 442 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-4db2nagx4s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15936/

Comments