MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
SHA3-384 hash: 12c0ae5f05164e6e6e90759ce5d5b9893addab0d8b6cf99082fc8692c692431c619857585f004705a67f54b4ac145947
SHA1 hash: faa44ac209a3627d542b2b695783b0bd2237f3e3
MD5 hash: a3c82910ba0e0f3b52d67c44007703a0
humanhash: angel-indigo-zulu-yellow
File name:4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
Download: download sample
Signature njrat
Create hunting rule
File size:643'584 bytes
First seen:2020-11-13 15:39:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:OGd0e3sLO3O0231V/VtUETLztT/24cm8lRrxaaeGbBYbbKaeDHvNTtT2jokb8vM2:p7O0M1V/VtUETLztT/24cm8lRrxaaeGZ
Threatray 191 similar samples on MalwareBazaar
TLSH A1D45C032DD89BE9F18E3332D59A994C07B4ED2114E5D72BECFA31990532392A917CE7
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:43:48 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=js7ligxlt3u4kez4osdnchcjhvxv5dzsxeek43aq5xrbh5xyyq5q._file
Verdict:
malicious
Similar samples:
061e4c2aaf9eb384ce88acacafa133185ede67c01c1ad01d1949218e04901c6b
njrat
20dbea65f9ea5d713ead877a8fdca2bb606af820520ea99fafcef39fc7652ce2
njrat
474453d6854784248699500221c30a6fb1a755e0a48308e567ea814481387f04
njrat
62875bbcc1ccebc66490cf8aa7781b959500dec28eee481312a1da08872eb465
njrat
c466e40f734907249b98c31faefbf51c6da78cfa88159f03f661a7b8157babbc
njrat
d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e
njrat
d344dbd1534297c5a51142faeb7911acd917232e2e52e61025986ced998c8aa1
njrat
d96b4c2e3c35806bc690cee0af92c060b51a649d036bd1d208565c710984c1ca
njrat
e3a10025b0133fbeb2e454ae7dfec1a6f0e49fee612f7139387f9396434762c6
njrat
f8c81561f37ddba17d61fcb467a60a449363b54e18440b7e4387f020f8eec556
njrat
+ 181 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion
Link:
https://tria.ge/reports/201113-4vfnaxwd3n/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
MD5 hash:
a3c82910ba0e0f3b52d67c44007703a0
SHA1 hash:
faa44ac209a3627d542b2b695783b0bd2237f3e3
Link:
https://www.unpac.me/results/51663907-4976-46e6-bad0-49b3cc013572/
SH256 hash:
36d3a4459eed3063ad954bdc3279ef8c32c2206bd9ef69daab6269eec287b412
MD5 hash:
db2b9425b64e0fccb6e1642c2f745d67
SHA1 hash:
56daea042274202c321dd6c3ff0bff44e6a3556e
Link:
https://www.unpac.me/results/51663907-4976-46e6-bad0-49b3cc013572/
SH256 hash:
812b8b06259da2d02ef6626cae9f3124d4c65bcd2b41dc2b7ea024db83ad13bb
MD5 hash:
fa95175c2857ec7b684c8a138eb61a7f
SHA1 hash:
5dce755486226f5da34110da8e52dd83103db899
Link:
https://www.unpac.me/results/51663907-4976-46e6-bad0-49b3cc013572/
SH256 hash:
c1b27c94e66d85e4527cb168443f56226339652f19eeac7a34098ba4521c78fa
MD5 hash:
ac5c6c5ee42da09cbedab2633748a30b
SHA1 hash:
5ee3dd8b8c9391f9ffbcf6a2ef46573b32fc907f
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/51663907-4976-46e6-bad0-49b3cc013572/
Parent samples :
93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/51663907-4976-46e6-bad0-49b3cc013572/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments