MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209
SHA3-384 hash: f688d55fa554f1181b3a7016b3ca786515e1f4c7a8f16c3c4a9bfef1bb445893dd606e94861786c324fbac4ec656eb68
SHA1 hash: 4dc241286c572a40d8351025013d820d54201e7c
MD5 hash: 8ca7c848c7cfaccea5b90146be8ceef5
humanhash: zebra-bacon-hydrogen-beer
File name:707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209
Download: download sample
Signature njrat
Create hunting rule
File size:1'178'120 bytes
First seen:2020-11-14 18:28:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:vOY97fYWsNskCRYu9hanV9PamHa37aWtDv395v:N7f+CRHKnV9CYa371Dvnv
TLSH ED45BE4273D1C072FFAA96739B2AFA11467D6D790063C41F13A83DB9AD721B1163DA23
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Autoit-8000278-0
Create hunting rule

Win.Trojan.Autoit-9790147-0
Create hunting rule

Win.Trojan.Autoit-9790152-0
Create hunting rule

Win.Trojan.Autoit-9790155-0
Create hunting rule

Win.Trojan.Autoit-9790166-0
Create hunting rule

Win.Trojan.Autoit-9790168-0
Create hunting rule

Win.Trojan.Autoit-9790176-0
Create hunting rule

Win.Trojan.Autoit-9790232-0
Create hunting rule

Win.Trojan.Autoit-9790239-0
Create hunting rule

Win.Trojan.Autoit-9790240-0
Create hunting rule

Win.Trojan.Autoit-9790242-0
Create hunting rule

Win.Trojan.Autoit-9790245-0
Create hunting rule

Win.Trojan.Autoit-9790251-0
Create hunting rule

Win.Trojan.Autoit-9790262-0
Create hunting rule

Win.Trojan.Autoit-9790267-0
Create hunting rule

Win.Trojan.Autoit-9790695-0
Create hunting rule

Win.Dropper.Nymeria-9791014-0
Create hunting rule

Win.Trojan.Autoit-9791035-0
Create hunting rule

Win.Trojan.Autoit-9791037-0
Create hunting rule

Win.Trojan.Autoit-9792204-0
Create hunting rule

Win.Trojan.Autoit-9792227-0
Create hunting rule

Win.Trojan.Autoit-9792274-0
Create hunting rule

Win.Trojan.Autoit-9792870-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Creating a window
Launching a process
Launching the process to change the firewall settings
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
njRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/535123
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
AutoIt script contains suspicious strings
Binary is likely a compiled AutoIt script file
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes (.Net Source)
Detected njRat
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 316661 Sample: kDD7rqMBYT Startdate: 15/11/2020 Architecture: WINDOWS Score: 100 34 redlan.hopto.org 2->34 38 Malicious sample detected (through community Yara rule) 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 10 other signatures 2->44 9 kDD7rqMBYT.exe 3 2->9         started        13 data.exe 1 2->13         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\Temp\...\data.exe, PE32 9->32 dropped 46 Contains functionality to inject code into remote processes 9->46 48 Writes to foreign memory regions 9->48 50 Allocates memory in foreign processes 9->50 52 Injects a PE file into a foreign processes 9->52 15 RegAsm.exe 3 4 9->15         started        18 schtasks.exe 1 9->18         started        54 Antivirus detection for dropped file 13->54 56 Binary is likely a compiled AutoIt script file 13->56 20 schtasks.exe 1 13->20         started        22 RegAsm.exe 3 13->22         started        signatures6 process7 dnsIp8 36 redlan.hopto.org 15->36 24 netsh.exe 1 3 15->24         started        26 conhost.exe 18->26         started        28 conhost.exe 20->28         started        process9 process10 30 conhost.exe 24->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209/
Threat name:
Win32.Trojan.Nymeria
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:31:33 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ob6svhobpt7aong4h32guttxmhmmq466kslcio33innmhsoawieq._file
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion persistence trojan
Link:
https://tria.ge/reports/201114-2dszqzk6vx/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209
MD5 hash:
8ca7c848c7cfaccea5b90146be8ceef5
SHA1 hash:
4dc241286c572a40d8351025013d820d54201e7c
Link:
https://www.unpac.me/results/0fc3d80d-2d69-4aad-974e-1daece5822ac/
SH256 hash:
540601cebaa24f199932322590f6084667ab3f7245924c74234f17adeb76a37f
MD5 hash:
0623a978c4595f76ec438afaa8164107
SHA1 hash:
05fa6bf7119767462174b42da8c419e404bfa3e1
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/0fc3d80d-2d69-4aad-974e-1daece5822ac/
Parent samples :
0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8
42a140cd4f88d3fd5db132a7ca258148031b917bb1207bd1570e53f800c55cb8
4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0
a584da6092123600c08e861ac0f14cd0ea41b95e4cd058b37ec70fc8dcf542d0
869f916839342a43032ac51d3574f7a9c057f73e319f8033c6338094376cab11
7c4e3cb6cdc2fd013561f3b657d7d660e5bb3d2f10b701c4dddbdea4fdd49e61
2bcfe505fb789c4ff8642b74897b70027367570c63680f2d77509543f6e4433d
60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd
d30b0d89c5e93b5bee54918d04d57370f1625455d7859f4061c47f13b9a779aa
1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d
57590a0d56dc1a2ddc1f73db742f4106f4cbb6e2f247020c5d4e12d78b1775d2
c964e9d4711c1cf0fb66db61b717b4215c5916355aed5fa44613d2f3251ccdf5
045323a02bf0cd8ffa742ba71963d87aa8c00eba637dad7c86757f0656e296a5
46650f8381483afc61f1bed735c56dfa6deace36bd272c123ab83edf7243aa80
cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864
707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209
ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009
0ab667dc59ad6ac24333bab211bf1bf9c85f90be59f12cfc7ca46b1ee2e9393d
8bc1e289657c8d1bbbc902bd0315dc20ae52a58cd045bfff5a550fab62ef56f2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments