MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb
SHA3-384 hash: fef642e9ffad0097bca395c405c780317e8fad2bf58a394fa96cd71ad908152d45099d0070d2fa0ea399f37a54e97696
SHA1 hash: af73b62ef114ecd873a5c7bf8805a8fb2afb63af
MD5 hash: 060896ba062faf202d69f4b0fded5a82
humanhash: ink-april-friend-tennis
File name:060896ba062faf202d69f4b0fded5a82.exe
Download: download sample
Signature njrat
Create hunting rule
File size:622'592 bytes
First seen:2021-06-22 14:38:56 UTC
Last seen:2021-06-22 16:01:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:iMpWFHmsPJ1SxlWPRLgbmoDJ7L8EA0XSt/rWYTl:nuHxGlWPRsDxZAPtzWYT
Threatray 243 similar samples on MalwareBazaar
TLSH B3D4CF303AD99615F27BAF7546E07151ABFEB223A713C5493D6003CA0A23F41DEE2536
Reporter abuse_ch
Tags:exe NjRAT RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
060896ba062faf202d69f4b0fded5a82.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 14:45:27 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/e7046d51-71c6-4eda-80e2-32197756ffa0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167616/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.862.1438.28770.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8163f17c-df34-47c0-848b-82e9014461c3
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806084
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
njrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 23:43:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sax7kpyhsvd4lopttl2vh7b5waydirjbhovokrbrh4i7e5upoo5q._file
Verdict:
malicious
Label(s):
njrat
Create hunting rule
Similar samples:
208a8cfdd915e43d58459d4e082efbbf58c649933c09c18c52bc95d34f9725ce
njrat
37534d1bed90b4a2b138f6734968b2acd4a2629c117edd680e3fb52c4afa739f
njrat
4191d513599205ace9e7d3e2cdf98b52b88b3ae1c1c01f2fc65ad1d992430137
njrat
4277fde72512aedcd199bfe2d51f005870a4c947dc4faa5c9806992b1af37c2c
njrat
5810c640bb4219ca39bc8a0c8b50f8447e5e47784e75dfdacdce65d5d2c31e47
njrat
687c0d0a7968f15884824b2b4144a19342e61f7ff65ad0eee82191f09731f95d
njrat
c0d0bb88f168055f81d335866bc16d4560348d6592714b8cf2e44355b1723942
njrat
db387432df2ea972484d10ca491dccdc021829bda4bdbd9e043acfaae645da33
njrat
e65ddcb1e8d85b5d13ab1aaf5d9747feea1e3e442ed82773640d740627f4d7ca
njrat
ea50bda60dc0b7ddb51891845a3dd8edd72f38fd1adfda12cd303d4982fe3f98
njrat
+ 233 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210622-zvfb8k88ws/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
1c5e0a0d909d1da24af87967a1e154c8aa490a1f99c6624e7214d20eb84f4fec
MD5 hash:
81faf15c7e3c9446d906659f7c7a9f16
SHA1 hash:
d7e05a22b109ce608109dc509029a7fe22b4b8bf
Link:
https://www.unpac.me/results/c51f91f7-5854-49f4-873b-2ba848047ca9/
SH256 hash:
a91d09bcd7326845622c596fdac327798c4bcd986e09364e11f87c3d5880b073
MD5 hash:
948f3f2d4d70ba3ec3979f37de1573b0
SHA1 hash:
b1cf6674fa7f3dfe5281d7c3595796d1c9a941c2
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/c51f91f7-5854-49f4-873b-2ba848047ca9/
Parent samples :
1c84bce4090447991d4190b6b90c8c5bc862fc8354e9f9000c77d0e05c087165
acd1a87efc13e04a5426583b47ef2eede10ad0898280e38f098dd1884c22ca5a
902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb
6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651
SH256 hash:
c54bfe111dea5f24ee0bd3942aaff88e123049de5ed711055f3ff21eb9a8a331
MD5 hash:
a308906492c0836dbbafc86d10410e8f
SHA1 hash:
04545711868a269242f2cf65ff56c46ec38dcc8e
Link:
https://www.unpac.me/results/c51f91f7-5854-49f4-873b-2ba848047ca9/
SH256 hash:
aa605c719c93174fcb11b97bc15ab3a64b478ec6c01eb9784366347b65e6bb24
MD5 hash:
820500af82c17fb201a374cf2c76e88e
SHA1 hash:
158344d6dcc541948c0342f2a7007506dfed68ea
Link:
https://www.unpac.me/results/c51f91f7-5854-49f4-873b-2ba848047ca9/
SH256 hash:
902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb
MD5 hash:
060896ba062faf202d69f4b0fded5a82
SHA1 hash:
af73b62ef114ecd873a5c7bf8805a8fb2afb63af
Link:
https://www.unpac.me/results/c51f91f7-5854-49f4-873b-2ba848047ca9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe 902ff53f079547c5b9f39af553fc3db0303445213baae544313f11f2768f73bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1336838/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/167616/

Comments