MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df
SHA3-384 hash: 9febc13c814da75bf66425f6e65ee418c7929dd1ce36e7d81db86f1b2e84181c7a92d991c088ba8821936c0d31f0a2ba
SHA1 hash: eea8fe248fc265ed39be46390d601d225359ea41
MD5 hash: 129c0f129fad8bcd201564cb091c7264
humanhash: maryland-south-timing-minnesota
File name:6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df
Download: download sample
Signature njrat
Create hunting rule
File size:818'176 bytes
First seen:2020-11-10 11:02:42 UTC
Last seen:2020-11-14 17:56:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:tQiskcTP8SfyrjvcK/UyDtoho9Nxp6FZ+Ujxup94DM3lBX0Jw5PZfLU5miKiksno:1sfNeJ/vDxwFTjpD8Zxf
Threatray 1'151 similar samples on MalwareBazaar
TLSH C5057CE97241E69FC80F443FF84B2C619385DB2E56EA814392C7751D127C6CE9AAC0DB
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 21:41:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyisujatbmppfa6wszxu7bfjaep6ur2h4vwbrbhxlvcjkqfhzdpq._file
Verdict:
malicious
Similar samples:
013272a7f6fd9926e268e175cfeb2bcb0aeab1573a68693c872a119bfdfa4402
njrat
09566b43ed2bfc7c75e430da0c041345cc4d91ec7fddb2a3f363d57aaab64437
njrat
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
njrat
3813d5fe541f008c96f3a0f367113a1fa3c047f08815fcd8335c4b829523ca28
njrat
448d1ee4b34c5fb936332394406ed67edf714be610cb633d9580ceb0c64781ce
njrat
45729be7af7c3a3c18d7b032a1797d63655fccd33c6e494a478356b55b29ce38
njrat
768ba740b576d48a67f88e3d3a59ad71003561ad4e95f8e9d9005686ad1ef5e9
njrat
7b0363c3b5a4dd50543d9afdb15e788a209212d030aad3d7f5d111c4259eda21
njrat
7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21
njrat
e0ecb16b450cfcfecdc7f258bfc5597a5718101ac97627018b2846f9c95e18b3
njrat
+ 1'141 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201110-znyva1v1ws/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
Unpacked files
SH256 hash:
6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df
MD5 hash:
129c0f129fad8bcd201564cb091c7264
SHA1 hash:
eea8fe248fc265ed39be46390d601d225359ea41
Link:
https://www.unpac.me/results/119fe651-645e-401a-b752-b5b6937135ef/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/119fe651-645e-401a-b752-b5b6937135ef/
SH256 hash:
c4bd5bf6ff903f331e79dbeeec5612d913c57c65f4845aef0c778d66e753e7f8
MD5 hash:
81c9ac103d22937a3d7aeb9e31f46cb2
SHA1 hash:
c248246d82e1323f6d337f76eb7199e380ccf321
Link:
https://www.unpac.me/results/119fe651-645e-401a-b752-b5b6937135ef/
SH256 hash:
ec48170e9de44632227e5f3dbfc912bcc7510e6954c626446f9d7b36d78a0c41
MD5 hash:
d52bdb2c581465ad40f34455daf81573
SHA1 hash:
f64c82e23b772b9ceb41f8397c15963e6a728156
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/119fe651-645e-401a-b752-b5b6937135ef/
Parent samples :
df91e3d8c094bb91bbc717a36ff7d42302b5f362aedde2333fac71cd42010a28
b85e964144a64d78fc54b4e6bae83ba6e1c7179f0a820f361c27f58842b6940a
81553f2de290ddf3a7dd40e0a8877781c8ac8cfb0fe5d0159a2b3ce3eda4c6f6
6e112a24130b1ef283d6966f4f84a9011fea4747e56c1884f75d449540a7c8df
3c62c78790e9af4f08177ae16bced8501967a30658db2c46fd638e48cfbc9b56
9dcd9722bae8dd0260f641d522553454b3f7fbc8df49ebb989a9257f38f42cec
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments