MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4
SHA3-384 hash: 1f2757455ac03a359c506022cf09c7ee215a75a009951a0ad39283bab8956d38a1eb73acc890c6b51d8fb871245e335d
SHA1 hash: 8b269bf3c4a85a2cff7537e7b7c77bd52d7d7264
MD5 hash: 59fcfad511f274a63bae875483d9302e
humanhash: beer-seven-zebra-early
File name:557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4
Download: download sample
Signature njrat
Create hunting rule
File size:1'466'880 bytes
First seen:2020-11-13 15:13:02 UTC
Last seen:2024-07-24 14:30:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cd6c8cceda8b0e47cf64c5128fde3f69 (17 x Loki, 9 x NanoCore, 8 x AsyncRAT)
ssdeep 24576:m2Wbdx5GqAMERv+Y1YcdduOvFHlnAKZGGSMmsVpnOSU3mqjKma3ZqnE:mDnGPZV7duO2GSMmSUxjKmWT
Threatray 2'420 similar samples on MalwareBazaar
TLSH DA65D02EA1A01837CD63293DCC0B5764A835BD112D69BA8E2BE70C489F7D75D39293D3
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Generic-9784581-0
Create hunting rule

Win.Malware.Generic-9784689-0
Create hunting rule

Win.Trojan.Generickdz-9784846-0
Create hunting rule

Win.Trojan.Netwire-9784905-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Connection attempt
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:13:49 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kv7cesmvoa2yh53pdxeekqjouvkwyp554dkzpz5sipkv7kxj7l2a._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
2cd90fecf4222117ecf6478b1ead6bfa0d059303949f0cd91654b9b92d78ec09
njrat
46bf7a6257a12bb2e56d9770eebc93606d9cf3f1f3af49ba987ebfef0ddb6216
njrat
56f27a73c491313639665758a863f1d00871d0b37077a03bfd5d50a4689d273d
njrat
723e0460b1864769c5779dbee1996e020eb1fac20540f713f4ff2c4346cfab1b
njrat
812a2ed477ffdac4f86746d587fd8a34ac9c1f6b65c15a38ac08079c32ecfdce
njrat
a34d092942adbd18c87bb10e5a851e66cdcd2febce66f8030d29d3e7f5ab25f0
njrat
ac8fcffe7966af957a58b52c744c026eff7acc393ffbc57d0fe9e8c2d901f68e
njrat
e3a18338921238575f176f679030eac3352c24066d8da0602b3c8b4e75bb1bad
njrat
e45aa38e4f734a6b5e9d8e55d3b71b16e4ae389eb7c857bbdaa98fb47e1d9ef3
njrat
fc926b2871dc293ad75ff0caf3863adc75b9342a34c1965c3991f512a2f666c8
njrat
+ 2'410 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4
MD5 hash:
59fcfad511f274a63bae875483d9302e
SHA1 hash:
8b269bf3c4a85a2cff7537e7b7c77bd52d7d7264
Link:
https://www.unpac.me/results/51171728-fa0e-4ac5-81f1-20f1eb1d86bc/
SH256 hash:
a546d35bbe15778f8886c978d5e0ca1bc871871ba37eb026e8093bf4d27d6adc
MD5 hash:
e13a247125d5988765a26cfec88bdc21
SHA1 hash:
91078bdd31b0d7c5ee29fa76e7c7ff98468c173d
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/51171728-fa0e-4ac5-81f1-20f1eb1d86bc/
Parent samples :
af0eb5679fd98e0644ff0b2c0dcff70d18892544245bfd73b09098542f95e8e5
557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4
SH256 hash:
64a55e62b8f6f924cdcd6842e1d073ace71a7c32628a12660e7609ab407b4626
MD5 hash:
b5af69ecfd315ad3700edfcc78fc3eee
SHA1 hash:
b1268de6bee486e5349827d9b1c7f77f80911b78
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/51171728-fa0e-4ac5-81f1-20f1eb1d86bc/
Parent samples :
af0eb5679fd98e0644ff0b2c0dcff70d18892544245bfd73b09098542f95e8e5
557e224995703583f76f1dc845412ea5556c3fbde0d597e7b243d55faae9faf4
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments