MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 16
| SHA256 hash: | 74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4 |
|---|---|
| SHA3-384 hash: | bd6e14f20ecb1716900f3805cdddb4667a9afce0bcb56baa4817d6433470ee0bab6ddc81f93f65c42ee9fca6cd9fd58d |
| SHA1 hash: | 1820da1f12be9f23a4de58bfb8d3bffc792b9754 |
| MD5 hash: | 67da6f5ed1373b2d46cfd8f1e9201970 |
| humanhash: | twelve-green-avocado-helium |
| File name: | 67da6f5ed1373b2d46cfd8f1e9201970.exe |
| Download: | download sample |
| Signature | njrat |
| File size: | 367'616 bytes |
| First seen: | 2022-12-03 08:00:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0ebb3c09b06b1666d307952e824c8697 (15 x RedLineStealer, 13 x LgoogLoader, 7 x NanoCore) |
| ssdeep | 6144:3jbeip2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltLKUPBXdRRLD1H5KPB:3uKAsEVC6qEJO/PdBQKGtpD1Zk |
| Threatray | 608 similar samples on MalwareBazaar |
| TLSH | T16F74F11396D0907AE0F523B099FB19A307BDBCA46E74A3AF820568D55C357D079B832F |
| TrID | 82.1% (.EXE) Win32 MS Cabinet Self-Extractor (WExtract stub) (303567/2/11) 8.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 2.8% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.3% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | 848c5454baf47474 (2'466 x Adware.Neoreklami, 103 x RedLineStealer, 70 x N-able) |
| Reporter |  abuse_ch |
| Tags: | exe NjRAT RAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
njrat
ID:
1
File name:
67da6f5ed1373b2d46cfd8f1e9201970.exe
Verdict:
Malicious activity
Analysis date:
2022-12-03 08:00:52 UTC
Tags:
trojan rat njrat bladabindi
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Enabling the 'hidden' option for recently created files
Running batch commands
Creating a process with a hidden window
Forced system process termination
Moving a file to the %temp% subdirectory
Replacing files
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Launching the process to change the firewall settings
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack.dll cryptowall packed rundll32.exe setupapi.dll shell32.dll
Malware family:
njRAT
Verdict:
Malicious
Result
Threat name:
njRat
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Contain functionality to detect virtual machines
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes (.Net Source)
Detected njRat
Detected unpacking (overwrites its own PE header)
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Skeeyah
Status:
Malicious
First seen:
2022-11-26 19:32:00 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
33 of 41 (80.49%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
njrat
Similar samples:
+ 598 additional samples on MalwareBazaar
Result
Malware family:
njrat
Score:
10/10
Tags:
family:njrat botnet:mybot evasion persistence trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Malware Config
C2 Extraction:
alka.ddns.net:4444
Malware Family:
n/a
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
f0eeefa3f3448e3a6c52cdfd1b05cbf77b5456533d518f1a0669a218c318cc51
MD5 hash:
1bb9a0b97126e38a8cb291c263513d9d
SHA1 hash:
3fd8ff8f4943280b687b363b21f9fcbe66b5aa7b
SH256 hash:
24cfff2d6343b27069780a39feeba02c9b6753aea77a105bce84012a64895fee
MD5 hash:
dc50c86c79c7c654c8f24714b30398b5
SHA1 hash:
a1f93226b81b06b2377f4d81d3627e98545b56a0
Detections:
NjRat
win_njrat_w1
win_njrat_g1
SH256 hash:
74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4
MD5 hash:
67da6f5ed1373b2d46cfd8f1e9201970
SHA1 hash:
1820da1f12be9f23a4de58bfb8d3bffc792b9754
Malware family:
njRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
0.90
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.