MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651
SHA3-384 hash: 247af7447d1c38e3c0246b797ceeffe6bdc4a867c7b77619f4e5d0011ada2ad27291c2abcb8f79ea7f613d847be7136e
SHA1 hash: 353885ea9dec8eb1dc62986b0e657dc6d714a8b7
MD5 hash: 4aa2b85b4040c5bf5af3f3ca541f0552
humanhash: juliet-mirror-artist-india
File name:4aa2b85b4040c5bf5af3f3ca541f0552
Download: download sample
Signature njrat
Create hunting rule
File size:1'097'728 bytes
First seen:2021-06-26 10:24:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:vujD+bAaMd3REebAaMd3AZwCEqwnMF0pJ6aUBRmAT1a:GmAaMVRE2AaMVqEqwGAJ6TvmAZ
Threatray 99 similar samples on MalwareBazaar
TLSH 6935E01029D5935AE1B6FB349DF0E7A58E2A7FA2BA13CC0E34E136472673B039E51135
Reporter zbetcheckin
Tags:32 exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4aa2b85b4040c5bf5af3f3ca541f0552
Verdict:
Malicious activity
Analysis date:
2021-06-26 10:28:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cee36ec1-8cdf-4691-818c-89ed80d1adf8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168466/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.867-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Win32.Save.a.18576.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/de5ee134-acdf-4b4c-9595-53f09610ad3a
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/808442
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-26 02:59:04 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=njtk2xdklvo7xvwozjauprzwvf3bs5rrb2ltvanmxv474m4raziq._file
Verdict:
unknown
Similar samples:
02dc856782b81740e20d02be3a51f9a20ef512c29077d6654ee0a6c1fc65c703
njrat
04f2bf850d32539660ffbadc861a721fc634bdeb6d2d9e09336024716ae9dae9
njrat
1823dd1d67def7b7f0df8ab785a80afceaaceb5088465304c80ecaa9f293a460
njrat
2960795548bdc081bce7c2b6931113fc2dbceec5778a0de4e988ace7522594aa
njrat
428e45ab1e675cd53981edd68a9d7989a78b267e069a8ce64415c5788c012212
njrat
5bae2ea5a5f69e0bbf5b5af6c835c8f326518fa90954a72e9fddf93b021ad1d5
njrat
a29d5d9dae6f9937c1f0dcf733031f3478d74f326c1913727eb9e65e53c82ab9
njrat
a3d6f15b63a6b27f9457d61e12e6943ee1d4be5f91d04225a2794692a5b7576e
njrat
c7dc8c5606612dcc0ef1dc8079c23971d4af7b6e047fcabeb5432b4253dc034d
njrat
f7437bba4e59178441160b2b89e5aa94ee2afca4f07b7f1a47d5e93468de4742
njrat
+ 89 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210626-x7c4qys3fn/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
a91d09bcd7326845622c596fdac327798c4bcd986e09364e11f87c3d5880b073
MD5 hash:
948f3f2d4d70ba3ec3979f37de1573b0
SHA1 hash:
b1cf6674fa7f3dfe5281d7c3595796d1c9a941c2
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/1a2245e1-76cb-4879-ab53-45a998c6a129/
Parent samples :
1c84bce4090447991d4190b6b90c8c5bc862fc8354e9f9000c77d0e05c087165
acd1a87efc13e04a5426583b47ef2eede10ad0898280e38f098dd1884c22ca5a
902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb
6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651
SH256 hash:
50d1c6af779aa92a8b90590cacc6dfcbff92293c12869bf3fb022c1bfaf43cb8
MD5 hash:
825082cffb92ab27d7f1049ba4764068
SHA1 hash:
9e38692d1f90018deb6128ca6ff1605179c1e28f
Link:
https://www.unpac.me/results/1a2245e1-76cb-4879-ab53-45a998c6a129/
SH256 hash:
f22ea4029b85545268f620fd6076be287bccffeca039bed81114e41ba2dcca9d
MD5 hash:
0e38db4691faabc6596bfcacabb93804
SHA1 hash:
5d7feb7cf9bd1ce13fb0e2255827a63bf5359a48
Link:
https://www.unpac.me/results/1a2245e1-76cb-4879-ab53-45a998c6a129/
SH256 hash:
6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651
MD5 hash:
4aa2b85b4040c5bf5af3f3ca541f0552
SHA1 hash:
353885ea9dec8eb1dc62986b0e657dc6d714a8b7
Link:
https://www.unpac.me/results/1a2245e1-76cb-4879-ab53-45a998c6a129/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe 6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/168466/
  
URLhaus
https://urlhaus.abuse.ch/url/1400668/

Comments