MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
SHA3-384 hash: 3b36549d06956f48c6aa85b4470a8ba8075e00b91b98505448b645bc9704c2da6a4707f708d3fdb5b1512cc514fd4646
SHA1 hash: 8c0ab901934fffdee77ed0d86f2d38a6713ec22d
MD5 hash: 57c0cea82b2fb3d3407af50fc673455b
humanhash: georgia-uranus-east-high
File name:44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
Download: download sample
Signature njrat
Create hunting rule
File size:83'456 bytes
First seen:2020-06-10 09:51:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:X/lI2wWuOqC7zZY2xVUKzuKNezM7byk1FALSb7EQNsfi05cy28GV3MPOd9c:PHBYshu5IywASPdsfiIRmd9c
Threatray 104 similar samples on MalwareBazaar
TLSH D7835A5AEB9BDF07DA5E027741B016A941759A031782F37778EC2FF60836BCD0642AC6
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Hpbladabi-6860330-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-05-17 03:55:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=isxncnrf3bs4n3bcvpphb4htebibpvuz6vgjegytrqzf3l2p4wua._file
Verdict:
unknown
Similar samples:
04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc
njrat
85e0ff2f0c03b8d8ce1d32b446dcef0e32b79fa581a9c27dcf4d0bb92c6b167f
njrat
ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc
njrat
c6226058a19d31ee5070ae94db3e63dc19c15f8b15fc933c57fb4cec0e4ecd30
njrat
d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
njrat
d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
njrat
e92abbc6be63f3e1144c883a40f758f701c6c856eac30c9565c88a0d0f6881c0
njrat
f6c6a59c54373d9a49e7a5a7aa859d6bda9f5826e4bb652f5898fa78c8748f39
njrat
fb3ca1866e216ffad74344e564be2f8aacabeb2c4616113d9fddf11561096bb6
njrat
fcb6176fe71dbce1d5474b52e65726dfd4687c6b72f31e7099ac5d79328f681e
njrat
+ 94 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-15br4hprej/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments