MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0
SHA3-384 hash: 246cbdc52aab27665659249b58f160d24b706dace8f6b5fe5c16234a264fc27b23293b6a18faf24663a4588c5cfbaf4f
SHA1 hash: 19bfc8f7c1d2346fe7423b18c46cc442b8862c8d
MD5 hash: f01f619c73540718da21c73eb83bfff3
humanhash: oven-lithium-video-minnesota
File name:5081e2b9049e6bd2e9947c09a28a356ebed0d066ec43ae37e4ab6e646bb3b6a0
Download: download sample
Signature njrat
Create hunting rule
File size:92'672 bytes
First seen:2020-06-10 11:53:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 1536:xrR+asXy3FIOLmYGGaim2bzg6GXY92Kc1xFvMzbKrKdRaCYcmQWQY6fm9:xEas1OLAA/g5XY9BkrvuhLYjQWQY6fm9
Threatray 38 similar samples on MalwareBazaar
TLSH B0936C9937FACE63C7CCD739906612806332C9297B03A7979AE4613E1CB27DE2D40617
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.CryptoObfuscator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:31:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kca6foietzv5f2mupqe2fcrvn27nbudg5rb24n7evnxgi25tw2qa._file
Verdict:
malicious
Similar samples:
16e2fadef5bcf0f418643eeefcfd53fb2bf6f51b1f1419b9e973a3a06f1d358c
njrat
2171947c8bc08fd32025d883f0668feefa0a43b4519889172df3dbc5f5ffe8d1
njrat
3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
njrat
40bdcc7f90d2bfa4b99928367f6ffca14065037637ae63940e5022b0ad7f648c
njrat
439d5c2dcf14e2f1b24463094aafde50e9a5702e451a624c2078aa32acc194dd
njrat
73f32ab414285cfff2040dacd956c2a9b53f156e7c8c0f3bad1e0317d61259cd
njrat
7f8ce0eabde719c8e568ac741f48f0d9d931b3da8172b26e53af451ffcea1e10
njrat
a71aa1ff58118ec6ca9cd4cdb4daf51eed8484ed0dffabad893e30803e06c62f
njrat
ceaa237a1cecea60118cad22275777cfa4ff64ea121d317d7e32ab3df4e10412
njrat
e3a5edee75299a8ddfa254fda955173f9063ec8081ba03d946f82f996a3b0203
njrat
+ 28 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201109-ab3btwvzax/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments