MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93a924da3e0e9c7cd63fc756581678664aea34e2f4a79bb1c7440be38445c037. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93a924da3e0e9c7cd63fc756581678664aea34e2f4a79bb1c7440be38445c037
SHA3-384 hash: 2386f755e921be51c827ed882c13c8f5d8b6e1bfd6d9a8297751035301aa1e398333a44d3378911d38a0a288f087cdea
SHA1 hash: f4f3bee86b33f02ddf93a31aeb678e8c63b499b8
MD5 hash: 4017b0dece2f3af02e20d5fd95697a7a
humanhash: berlin-cola-avocado-high
File name:93a924da3e0e9c7cd63fc756581678664aea34e2f4a79bb1c7440be38445c037
Download: download sample
Signature njrat
Create hunting rule
File size:85'092 bytes
First seen:2020-06-17 09:36:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 1536:5/yFfs+268ypDbThIWYX2NCqtw9BHpQ/ZIHj8sIK:pyFf7dvThIWYX2NCqtwfi/ZIHjQK
Threatray 358 similar samples on MalwareBazaar
TLSH 8583190366DEBEA2E13A1634233346D4C7E9ED010102E35E3DC9759A49F9687BF827D6
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19446/
Detection(s):
SecuriteInfo.com.Atros3.ABOU.10825.10917.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-06-13 23:07:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sousjwr6b2ohzvr7y5lfqftymzfounhc6stzxmohiqf6hbcfya3q._file
Verdict:
malicious
Similar samples:
10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc
njrat
448c36ca3546f4444da82e6889980c21bf6f148e6451a9cfb92ec60547b6c41b
njrat
65878cef4e2fdd03c3c08a4070105ebe37c0c0f311679a0c21208ac9f8f7c069
njrat
72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
njrat
7657c4fe9e815bc0f3feb18ce27b913cc29e48977d704b9af288c3895fa72cf8
njrat
b0fedb5fc4232c07ff1161ddcc830cf11596ba2653cc7cea1d5666b4bab1f276
njrat
bb301ca8c6b4567553fd8d0b7ddb4425109f5cb865bc209569a156260f72f6c7
njrat
bbb44461205442d3644ee3137f495777b46d2cc9cc2039a6138571037c843342
njrat
e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13
njrat
e4cdb94099f1ea5610412795ecf5a825b52e4f3d239256d76bff88105fe4acf8
njrat
+ 348 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat
Link:
https://tria.ge/reports/200624-vf5c864pyj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19446/

Comments