MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6427f0361a3101a575c54575674ca52a241b8b295954609ce2dd5d5200c0b3a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	6427f0361a3101a575c54575674ca52a241b8b295954609ce2dd5d5200c0b3a8
SHA3-384 hash:	4e79f51c0a87b86c623b1c6fe13f230ea96186249fcbcfda55b1055de0ca70d0436059aa3c4c10585972c6cf94e9e25a
SHA1 hash:	24b0e68efe814004bc2ac3283af857fe9e8a9bf9
MD5 hash:	235d3d833701fc0f8407b59fd299a443
humanhash:	artist-ceiling-juliet-venus
File name:	2FcxEUVb.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	29'696 bytes
First seen:	2020-09-25 11:17:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep	384:o2nLNl73t5otQMOdePp5TdNZmGmqD8ZneQqGBsbh0w4wlAokw9OhgOL1vYRGOZzY:37jo2MzBvb4qcneQBKh0p29SgReH
Threatray	322 similar samples on MalwareBazaar
TLSH	26D209183BB94906C4BC0B74C93196575AF486032513DFAFDDD1A8DA9EF72E8290CBE1
Reporter	pmelson
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

Vendor Threat Intelligence

Detection:

njRat

Link:

https://www.capesandbox.com/analysis/65798/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Creating a process with a hidden window

Creating a window

DNS request

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Launching the process to change the firewall settings

Result

Threat name:

njRat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/475029

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious names

Detected njRat

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Uses netsh to modify the Windows network and firewall settings

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Detection:

njrat

Link:

https://mwdb.cert.pl/sample/6427f0361a3101a575c54575674ca52a241b8b295954609ce2dd5d5200c0b3a8/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2020-09-25 11:19:07 UTC

AV detection:

28 of 29 (96.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mqt7anq2gea2k5ofiv2wotfffisbxczjlfkgbhhc3voveagawoua._file

Result

Malware family:

n/a

Score:

8/10

Tags:

evasion persistence

Link:

https://tria.ge/reports/200925-qcz389ns6s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies service

Adds Run key to start application

Loads dropped DLL

Executes dropped EXE

Modifies Windows Firewall

Unpacked files

SH256 hash:

6427f0361a3101a575c54575674ca52a241b8b295954609ce2dd5d5200c0b3a8

MD5 hash:

235d3d833701fc0f8407b59fd299a443

SHA1 hash:

24b0e68efe814004bc2ac3283af857fe9e8a9bf9

Detections:

win_njrat_w1

win_njrat_g1

Link:

https://www.unpac.me/results/65d87093-c789-4892-8f05-245c5f9c9565/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NJRat

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6427f0361a3101a575c54575674ca52a241b8b295954609ce2dd5d5200c0b3a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	RAT_njRat Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
Description:	Detects njRAT
Reference:	http://malwareconfig.com/stats/njRat