🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 9


Intelligence 9 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f
SHA3-384 hash: 42d53a3bca1605d248df71a41c1e09c294132b61fd8c203a9529049c8fcc3c2d62c0fa88dd3973a2fb87205fc0ccffed
SHA1 hash: 469daf366689835bcb4487220eabe66b08e7c10c
MD5 hash: a7a2ec958a2f5e012e786ab63cb220c1
humanhash: mike-grey-october-ink
File name:a7a2ec958a2f5e012e786ab63cb220c1.exe
Download: download sample
Signature njrat
Create hunting rule
File size:710'260 bytes
First seen:2021-06-07 05:43:27 UTC
Last seen:2021-06-07 07:18:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet)
ssdeep 12288:0hxp3lZnT9bDz9d3ZANokaGpCDLSBSGzNJ5:0Jlh9bDBdmukaGtbz75
Threatray 749 similar samples on MalwareBazaar
TLSH 89E4AE92E6824CB1F8201B795432AE3A113F7F786D34956E93AC7836FB731C2153598B
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
3.22.30.40:11572

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
3.22.30.40:11572 https://threatfox.abuse.ch/ioc/72170/
3.17.7.232:11572 https://threatfox.abuse.ch/ioc/72171/

Intelligence

File Origin
# of uploads :
2
# of downloads :
318
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a7a2ec958a2f5e012e786ab63cb220c1.exe
Verdict:
Malicious activity
Analysis date:
2021-06-07 06:37:35 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/278202b7-8f67-484c-a489-7f51fec96d6a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/164864/
Detection(s):
SecuriteInfo.com.Trojan.Rasftuby.Gen.10.4876.31310.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process from a recently created file
Sending a UDP request
Delayed reading of the file
Deleting a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Creating a file in the %AppData% directory
Creating a file
Creating a process with a hidden window
DNS request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Launching the process to change the firewall settings
Sending a TCP request to an infection source
Result
Threat name:
njRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/797781
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Detected njRat
Found malware configuration
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 430175 Sample: r8jU0taA7D.exe Startdate: 07/06/2021 Architecture: WINDOWS Score: 100 41 0.tcp.ngrok.io 2->41 51 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->51 53 Multi AV Scanner detection for domain / URL 2->53 55 Found malware configuration 2->55 57 8 other signatures 2->57 12 r8jU0taA7D.exe 13 2->12         started        signatures3 process4 file5 39 C:\Users\user\AppData\...\Server.sfx.exe, PE32 12->39 dropped 15 cmd.exe 1 12->15         started        process6 process7 17 Server.sfx.exe 9 15->17         started        21 conhost.exe 15->21         started        file8 35 C:\Users\user\AppData\Local\...\Server.exe, PE32 17->35 dropped 49 Multi AV Scanner detection for dropped file 17->49 23 Server.exe 1 5 17->23         started        signatures9 process10 file11 37 C:\Users\user\AppData\Roaming\proverka.exe, PE32 23->37 dropped 59 Antivirus detection for dropped file 23->59 61 Multi AV Scanner detection for dropped file 23->61 63 Machine Learning detection for dropped file 23->63 27 proverka.exe 4 23->27         started        signatures12 process13 dnsIp14 43 3.13.191.225, 11572, 49718, 49719 AMAZON-02US United States 27->43 45 3.134.125.175, 11572, 49723, 49773 AMAZON-02US United States 27->45 47 5 other IPs or domains 27->47 65 Antivirus detection for dropped file 27->65 67 Multi AV Scanner detection for dropped file 27->67 69 Machine Learning detection for dropped file 27->69 71 2 other signatures 27->71 31 netsh.exe 1 3 27->31         started        signatures15 process16 process17 33 conhost.exe 31->33         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f/
Threat name:
Win32.Trojan.Rasftuby
Create hunting rule
Status:
Malicious
First seen:
2021-06-05 02:12:37 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q52pclkwcwnhzpyoryvdmgdsd2u4ui5hmqp6pwsbpladqc27rv7q._file
Verdict:
malicious
Similar samples:
0087b8cfcb8eeeb038ccf007e78e78c18001c79b440891853893851887e88738
njrat
1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c
njrat
22624e441ebb33943e4c72b4f4c3b625b0f7ec3d8b2afada33a92771144b0373
njrat
2a22805bbe73a869fc9240d722d6cfb22c582683918103bda90f3a321756c44d
njrat
329c2259d6015d98464322b873b783d18da6ac1a13d7ec40d1de9f143659b1bb
njrat
6cb0c6c55411375878184fba0feeee93c99c7f184818449e548ef875486ec38a
njrat
a43c0d39f01808746f82c041edad38edbb89334c098311331d3e2733824f6259
njrat
c7b54cc4aa3d4b08652359ddb2e8b0d91ccd6d0a01c7a34eb527fde4f0f44957
njrat
ed34d4eba0bc7d434f32bb9bca0147632592656ddf0c2aa892fbee54b0850ff1
njrat
ffe8dbc4f815fe713c790a19b5122c79d1de9c817f10edf7d86ca297175ce439
njrat
+ 739 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion
Link:
https://tria.ge/reports/210607-3a5yybc8d6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
Unpacked files
SH256 hash:
8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f
MD5 hash:
a7a2ec958a2f5e012e786ab63cb220c1
SHA1 hash:
469daf366689835bcb4487220eabe66b08e7c10c
Link:
https://www.unpac.me/results/5613ff25-c29f-4f11-a305-cffef73c7b21/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/164864/

Comments