MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44f4f177451fb372e7bdb38a81c93bf82de9e8e1f64622fa09e591afb48f3b1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44f4f177451fb372e7bdb38a81c93bf82de9e8e1f64622fa09e591afb48f3b1a
SHA3-384 hash: a637a438c90cba8af335db9761407413ede5821cc01c462aa165a7db47c09d572d4a9ee29a7a40e8a8bc8b603ec61e20
SHA1 hash: 5635225c135df4a080c98155b519dc81c398c36a
MD5 hash: a9162f33540715977f0ef2bc692336c4
humanhash: pasta-uranus-orange-six
File name:44f4f177451fb372e7bdb38a81c93bf82de9e8e1f64622fa09e591afb48f3b1a
Download: download sample
Signature njrat
Create hunting rule
File size:481'280 bytes
First seen:2020-06-29 07:24:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:yMasoWDnclxHRBtzwWs1ngkMyK07aptPlToN4LAu:Pe9MbWu
Threatray 433 similar samples on MalwareBazaar
TLSH 40A41AB93BFE9049B677FF22DFA6B284EE6A77725505954A10C8030B4432C41EEB3935
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15600/
Detection(s):
Win.Packed.Bladabindi-7082976-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44f4f177451fb372e7bdb38a81c93bf82de9e8e1f64622fa09e591afb48f3b1a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 16:28:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=it2pc52fd6zxfz55wofidsj37aw6t2hb6zdcf6qj4wi27nephmna._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
36a2f14e47f2e356a86679b2d3812576257978f2e8b9d4e2c16c884f4efb38b7
njrat
4203720a4d4d988958a592e89d937e987e95fe7d8b7417a70d88ff62c5dbd77b
njrat
4c7aa908b8b0f65ba2fa635d033211e4a7664a8f3fa2fb297424c8a21e4783f5
njrat
52acc00d0564ad9cd64f3d099cd5d074912bfb160f923b20e8c732455a2a20a1
njrat
80e373ee8f746e0efaa489ac20fffa65ca659ba8c4edffef2d122c33051c1837
njrat
887afb0090c2878cf0727e35f5d33cd97aa9964f6193c4ebd1770493279a1263
njrat
b39e096b204c009b28f80f36a5b197539cb24d7f670eed000d7fa3db347298b1
njrat
c25df2651a747220690ee62f23e4246ce37765ec5d1ef624f156af3f0f14041b
njrat
c48ab81f93ccd69c6d2b796cb4f431db97179480bf6251b715347b0b32dd500e
njrat
d2cc729be39a3136dde1a0e312f2cf6bffbcf4159f3b724b980e5ac2419a398c
njrat
+ 423 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200629-tq57wmysba/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15600/

Comments