MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb
SHA3-384 hash: cd066cd9f9754d7f42df14b2ebe27548450d211168f9c5e237de81989ddf1e0894fad967e9f1a92f159dea591d31cc6c
SHA1 hash: 4eff8c83b9f56910accbfaeea4c98e7c5a3a8a0b
MD5 hash: 2079cf14ac364de928efdb1e8b4bd34e
humanhash: jupiter-apart-lactose-utah
File name:2079cf14ac364de928efdb1e8b4bd34e
Download: download sample
Signature njrat
Create hunting rule
File size:486'400 bytes
First seen:2021-06-24 00:17:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:Js4ItRFieplctJlQnVo0va9aDmlRUJ06nrP/4F3MKKXoHHQUKVLO9ze2UDHQaXkW:JsttRFieplctJlQnVo0DmlRUJ06nrP/F
Threatray 123 similar samples on MalwareBazaar
TLSH DBA4D73BB9508A02C1885A37C2DB94145FF6FD872323D24A7A8933551B523FFE84E6D9
Reporter zbetcheckin
Tags:32 exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2079cf14ac364de928efdb1e8b4bd34e
Verdict:
Suspicious activity
Analysis date:
2021-06-24 00:21:40 UTC
Tags:
rat njrat bladabindi
Link:
https://app.any.run/tasks/50d2754b-ebaa-4519-a34b-37922702b25d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Dropper.njRAT-7473933-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97e1801b-e805-40de-bbe6-a59dd31efe92
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806977
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 14:16:12 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=msx5u55khoysr4ilsgvnyzctftd4so5pcw3aet453tmc4irjt3fq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
0290b4bba5483f6c9865c8b2a1df7e0756a6d5ade4a2dc5ced0a380a9988d35c
njrat
1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8
njrat
3eee101d3dc8a6adfb1168bd543bcb2fe419959050878fa47e98cc9587697c26
njrat
692558730f0958f58d37105b4926fb64fb75245f246ed752078ed576ea555e7b
njrat
72e7cc356ae54233b8d85e2850edd6d998f60e3521e1b58d64281835529d43dc
njrat
7490493c29c4dd5b704a2ab854310b61b246d25b585c6a9f08232bd6bc221a98
njrat
8f9f89be357d1d17b6281bf9f6caebfa97fdbfcb6aec50e4aa147d0e24e909e7
njrat
92715192ee868e9d408f9449893688c609bb81fb522f9af00f9cf8caeaf098a2
njrat
aa703ba4b6b97339a2d84fca6c433da3118f4930ffd27d7bd401a82d7a722e29
njrat
e7f93c2a012002bd558069f5d5d7b20ee1df9ecade97d85f6edd9e0b66be0623
njrat
+ 113 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion trojan
Link:
https://tria.ge/reports/210624-z5sh8lxz8n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
cb5769ad131cd848f4e1eccfb5a564f184215e4a3361e9d31b210cb52aa7ba12
MD5 hash:
e49d03d31fe87a0cd9d40880960e7b87
SHA1 hash:
f321f001e4b87abb348218ac295231ab96580e95
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/8a36669e-853e-4de1-bf74-c28d60003a27/
SH256 hash:
64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb
MD5 hash:
2079cf14ac364de928efdb1e8b4bd34e
SHA1 hash:
4eff8c83b9f56910accbfaeea4c98e7c5a3a8a0b
Link:
https://www.unpac.me/results/8a36669e-853e-4de1-bf74-c28d60003a27/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe 64afda77aa3bb128f10b91aadc64532cc7c93baf15b6024f9ddcd82e22299ecb

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1393014/

Comments