MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8
SHA3-384 hash: 2f72b0470b240f121c8070a654691609aa9d2488c5a0dada38c7f8c01fbefae255b5787056e8630f80deec5c839aa26c
SHA1 hash: 8a858ee7bc9509f4fda27e36bef6b443a4f9d3ef
MD5 hash: 647bd366b77856d865de35044c8e2738
humanhash: connecticut-spring-table-fourteen
File name:79CB57DF157C97E8256EF650EA1138FC1340FD4FC3762.exe
Download: download sample
Signature njrat
Create hunting rule
File size:543'167 bytes
First seen:2023-03-15 07:30:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ec52b856484588a741da264a7e0bd180 (1 x njrat, 1 x Sality)
ssdeep 6144:JoCb5nZUOzWGw9wpX/FqKKQ8sY0xWKGZqoFF6u9IW5Tp76vemgkl1h/1KndMFrYY:OAZk6N58sjxWRZqoSuSk76vvjl1XKda7
Threatray 266 similar samples on MalwareBazaar
TLSH T103C4F1717E424CB6D84839F0B96D51E05B2D7E2AB1A8576713B8310D34B86B3DD22B3E
TrID 85.8% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
4.2% (.SCR) Windows screen saver (13097/50/3)
3.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 19192167d3ebeb67 (2 x njrat, 1 x QuasarRAT)
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
90.153.238.135:3030

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
79CB57DF157C97E8256EF650EA1138FC1340FD4FC3762.exe
Verdict:
No threats detected
Analysis date:
2023-03-15 07:32:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f5f27c73-055c-4a48-9904-c86248c8f7e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/374469/
Detection(s):
PUA.Win.Packer.RarSfx-1
Create hunting rule

PUA.Win.Packer.RarSfxModificat-1
Create hunting rule

SecuriteInfo.com.Downloader.Generic7.AEYP.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/73235/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6411743706c49bd8b6b5e385/reports/d4b2603e-83ee-4248-8046-4d456a3340d1/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8794ab18-c417-4861-947c-834fd0c09623
Result
Threat name:
DarkComet, Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1193937
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the document folder of the user
Drops PE files to the startup folder
Installs a global keyboard hook
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
Yara detected DarkComet
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 826838 Sample: 79CB57DF157C97E8256EF650EA1... Startdate: 15/03/2023 Architecture: WINDOWS Score: 100 61 Snort IDS alert for network traffic 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 Antivirus detection for dropped file 2->65 67 8 other signatures 2->67 9 79CB57DF157C97E8256EF650EA1138FC1340FD4FC3762.exe 6 2->9         started        12 nr.exe 3 2->12         started        14 nr.exe 2 2->14         started        16 3 other processes 2->16 process3 file4 47 C:\Users\user\Desktop\MCR.exe, PE32 9->47 dropped 18 MCR.exe 3 4 9->18         started        process5 file6 39 C:\Users\user\AppData\Local\Temp\nr.exe, PE32 18->39 dropped 41 C:\Users\user\AppData\Local\Temp\da.exe, PE32 18->41 dropped 69 Antivirus detection for dropped file 18->69 71 Multi AV Scanner detection for dropped file 18->71 73 Machine Learning detection for dropped file 18->73 22 da.exe 1 3 18->22         started        26 nr.exe 5 5 18->26         started        29 notepad.exe 18->29         started        signatures7 process8 dnsIp9 43 C:\Users\user\Documents\DCSCMIN\IMDCSC.exe, PE32 22->43 dropped 75 Antivirus detection for dropped file 22->75 77 Multi AV Scanner detection for dropped file 22->77 79 Drops PE files to the document folder of the user 22->79 81 Creates an undocumented autostart registry key 22->81 31 IMDCSC.exe 3 22->31         started        49 xman-nn.ddns.net 26->49 45 C:\...\abaf700a958de013d7b849251fdcb386.exe, PE32 26->45 dropped 83 Machine Learning detection for dropped file 26->83 85 Creates autostart registry keys with suspicious names 26->85 87 Creates multiple autostart registry keys 26->87 89 3 other signatures 26->89 35 netsh.exe 3 26->35         started        file10 signatures11 process12 dnsIp13 51 xman-nn.ddns.net 90.153.238.135, 3030, 49691, 49699 INT-PDN-STE-ASSTEPDNInternalASSY Syrian Arab Republic 31->51 53 Antivirus detection for dropped file 31->53 55 Multi AV Scanner detection for dropped file 31->55 57 Machine Learning detection for dropped file 31->57 59 Installs a global keyboard hook 31->59 37 conhost.exe 35->37         started        signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-09 18:18:48 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=phfvpxyvpsl6qjlo6ziouejy7qjub7kpyn3ctjo47vtm7zknqxua._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
04789bb1e63b81997e53786d1f19a6dde477b29b54ad5bcb12aeb9bce3d0f72b
njrat
4a9c0231a34465924266db441a25a9454e27332c36224267841c88f1aaab39dc
njrat
6480e18b692e5d6852be0ef39b265c943ca01a2ba1249efec660d447f1915cb2
njrat
c7786e3cb22e7a6794d63cd9858ac55429f2bc4942769bcc94ded89ca4f9f0fa
njrat
daf01c5114ac5dd2e6a52d4ce4174e19482ed9f4d0409d734bc3c39a29f48497
njrat
f848632cde166bb8288dfc4478c0b76c9026880d8fbb272e9ea91fdbc4ed6b65
njrat
+ 256 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230315-jcc9dsea4t/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8
MD5 hash:
647bd366b77856d865de35044c8e2738
SHA1 hash:
8a858ee7bc9509f4fda27e36bef6b443a4f9d3ef
Link:
https://www.unpac.me/results/b7c09216-7490-40a9-91df-cefdc15b912f/
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/79cb57df157c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/79cb57df157c97e8256ef650ea1138fc1340fd4fc37629a5dcfd66cfe54d85e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/374469/

Comments