MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 812464aa0dfc28db563abf6f12caba88f4c8998ad5813741b781c3ddbcba1eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 4
| SHA256 hash: | 812464aa0dfc28db563abf6f12caba88f4c8998ad5813741b781c3ddbcba1eaf |
|---|---|
| SHA3-384 hash: | 9289d248f508669ad2636c3b23e95908bd4a8871b2c1f3678915de8052b9b8c7d5827f32dd88945ef2da366c9a74a29a |
| SHA1 hash: | 1b610c0bca5caf1e5bdcd409949c269b7e51313d |
| MD5 hash: | 22ae02a0257adbbf653910e99f3cf6cc |
| humanhash: | jersey-green-august-november |
| File name: | bunzipped |
| Download: | download sample |
| Signature | njrat |
| File size: | 140'288 bytes |
| First seen: | 2020-06-17 05:23:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 3072:s59ZqNXGJoDAsdXMuhuz+bAd7j5+XpidGClihmQi:ccG2DAoIz3nFdBi |
| Threatray | 130 similar samples on MalwareBazaar |
| TLSH | 17D3BF0D36AC5339CA7C9B3C98F126440BF8A967B512EB5D9E8431EB1C63BC55A42F13 |
| Reporter |  abuse_ch |
| Tags: | bunzipped NjRAT Outlook RAT |
abuse_ch
Malspam distributing njrat:HELO: NAM10-BN7-obe.outbound.protection.outlook.com
Sending IP: 40.92.40.62
From: roselveth mosquera vargas <roselmos@outlook.com>
Subject: Convenio Arreglo De Pago Comparendos Vencidos.
Attachment: Convenio de PAgo.exe.bz2 (contains "bunzipped")
NjRAT C2:
medallos.duckdns.org:2054 (46.246.80.66)
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-06-17 00:56:24 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 120 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.