MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6172ae75fca2550266d932f8b7a5bb55fbfd5ac7342136c1082c50a839afb6c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 7
| SHA256 hash: | 6172ae75fca2550266d932f8b7a5bb55fbfd5ac7342136c1082c50a839afb6c1 |
|---|---|
| SHA3-384 hash: | d6a8a72ba30f8e586bc963e6613ac1930f3fa7e078b9254aaf722732c199add004ccf5ae34ecdaa9513a339b71766fd2 |
| SHA1 hash: | 4123d250fc8ae7a2694c8fc49163719b451f29e3 |
| MD5 hash: | 90d94f0314a929fe4c2505cb89b6d523 |
| humanhash: | september-michigan-lima-eleven |
| File name: | 6172ae75fca2550266d932f8b7a5bb55fbfd5ac7342136c1082c50a839afb6c1 |
| Download: | download sample |
| Signature | njrat |
| File size: | 29'696 bytes |
| First seen: | 2020-11-07 17:03:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0331ca1875ee1266bf09953125b712b1 (13 x njrat, 2 x DCRat) |
| ssdeep | 768:c7QRJ1jcv08UwdpSB5TKXPNEGNg+PbH9Xp9quzW:5RJ1jcvDUcpSPmXPRZXp9qr |
| Threatray | 133 similar samples on MalwareBazaar |
| TLSH | 1BD2E1CFA41E3936EC80B970744E9264F7515A740392A6C93FD8CC66A1F3AEA03124CA |
| Reporter |  seifreed |
| Tags: | NjRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Creating a file
Creating a process with a hidden window
Connection attempt
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.VBinder
Status:
Malicious
First seen:
2020-11-07 17:06:51 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 123 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
evasion persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Modifies service
Modifies service
Adds Run key to start application
Adds Run key to start application
Drops startup file
Drops startup file
Loads dropped DLL
Loads dropped DLL
Executes dropped EXE
Executes dropped EXE
Modifies Windows Firewall
Modifies Windows Firewall
Unpacked files
SH256 hash:
6172ae75fca2550266d932f8b7a5bb55fbfd5ac7342136c1082c50a839afb6c1
MD5 hash:
90d94f0314a929fe4c2505cb89b6d523
SHA1 hash:
4123d250fc8ae7a2694c8fc49163719b451f29e3
SH256 hash:
7cdd38714036426e4c07a0dae7304a5a44f43441f165a5575c15ac67a7b0ad1e
MD5 hash:
3446a189af4fb67d9c5b7658d2fcd535
SHA1 hash:
c8bdbbcc14eb427e32fbd2253405109cc30b20c7
Detections:
win_njrat_w1
win_njrat_g1
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.