MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667
SHA3-384 hash: 13f84a541b6018be3a638309afc3218c4a42770ce3d05b9056f2e214f1ca484c401e07e8b0dafb6f183d822a46e530bb
SHA1 hash: 05e4d6773898d1e8ce247217c09bf70521f3f9fd
MD5 hash: 4ad4f2326a267bf7670944c88c7e752a
humanhash: gee-music-nitrogen-seventeen
File name:FACTURA.r00
Download: download sample
Signature njrat
Create hunting rule
File size:188'090 bytes
First seen:2021-03-29 14:49:56 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 3072:iYzxnMTzqT7xB8rZO7E4vLuDT95HQLdUV0uOhINLPgl3Q25xXq3Ln3I:iYhwzqHx6rkZDuN5wvhINLQ3Q8xXq3TI
TLSH 190412275E69E4FDE60A50D0A48D121B0F78FEE0B38FFE51AD8E8F8146A57039903D55
Reporter abuse_ch
Tags:ESP geo NjRAT r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: assistcard.com
Sending IP: 45.137.22.138
From: Monica Gisel Cavita Ledesma <Monica.Cavita@assistcard.com>
Subject: Factura final - ¡Cuenta bancaria de la nueva empresa!
Attachment: FACTURA.r00 (contains "FACTURA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 14:50:07 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jrzprffr657ttkcb5ii2xbls3aod7vjf46govt2ljswuenfo2ztq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

r00 4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667

(this sample)

njrat

Executable exe 92b11183a34d5b832d8848a1b57e41765845ecc2f79050606e2ad914b417f336

  
Dropping
MD5 42f672f78b9c71fd542d3162af32fa3b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92b11183a34d5b832d8848a1b57e41765845ecc2f79050606e2ad914b417f336

Comments