MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
SHA3-384 hash: 3a3e549aaf86fd071051adc6607b93e3c18a24563da4e379b80f4b2158824fc578d001cd41fb47993658659bff6dc73b
SHA1 hash: fe1fbd479b0318768d57c53bcf3d2c8ce6bb87ff
MD5 hash: c933a2c0275415ade2d5ac303ea3b9b6
humanhash: fanta-foxtrot-grey-undress
File name:88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
Download: download sample
Signature njrat
Create hunting rule
File size:1'125'376 bytes
First seen:2020-06-29 07:19:23 UTC
Last seen:2020-06-29 07:45:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 80 x RedLineStealer)
ssdeep 24576:l7ZzyjlHzn2CEvXUTvOx3Z1Uj9MBU/m1zgM:pZzyZTngvXaf/m1b
Threatray 14 similar samples on MalwareBazaar
TLSH 6D35339309E2F66ACCBD27F0DF3A643C42264E68529B4F85B34E05C079A568F0FD5D49
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15534/
Detection(s):
SecuriteInfo.com.Mal.Generic-S.1057.20656.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da/
Threat name:
Win32.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 19:32:29 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdqdenvsjdiajerrmhdzfcqvi3g77ufw5dbquivr2snqlxfjwlna._file
Verdict:
malicious
Similar samples:
0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb
njrat
45e9959441e6e30c4c7a4dd8b3d56b88ad09d2ad253851ea79be62ec9c1c8f68
njrat
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
njrat
54488d42558df58d9694b6a6150e4934c045c588566be3a555c005ce0aa4ab39
njrat
7ec599424a161fe942345c2336dd0cfb8c7d64e6e72b8e90efd999328b06cc04
njrat
9cda5e5ad6ca68a803516013fbf62e6b06383b20fccf1ee6aed4730c916a3b55
njrat
c2a307a15f392b72cc51b12a1061c6ad7a2e76843754ee3d2e7b8ba0bc17e540
njrat
e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf
njrat
ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b
njrat
eddc999a7e76c2af01abaa813a903686f6f5b7ff94a7587c071bf2d2243b5239
njrat
+ 4 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200629-p99z2a514j/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run entry to start application
Loads dropped DLL
Drops startup file
Executes dropped EXE
Modifies Windows Firewall
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_Honker__builder_shift_SkinH
Create hunting rule
Author:Florian Roth
Description:Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe
Reference:Disclosed CN Honker Pentest Toolset
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15534/

Comments