MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
SHA3-384 hash: c9a225158de7b8cdda33a66f25e5bfb606a0dc892610b034069b4e4a457c7f15836a779a8d448b93f905ffcc5dc3917a
SHA1 hash: 41b2e6b01e660cd86a75c2f4ab33e2c2583795cd
MD5 hash: 26fe571c0c34e3e5d13196275ce27dfb
humanhash: high-magazine-georgia-six
File name:93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
Download: download sample
Signature njrat
Create hunting rule
File size:321'536 bytes
First seen:2020-11-06 11:13:32 UTC
Last seen:2020-11-07 17:13:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:yRqcaALkRfb/ogDVnGHFfKX9uG9ipqxPTvSRN+j3j84tRBnTnde:UdLqvhDMG9i8TvSmTptjnTnde
Threatray 28 similar samples on MalwareBazaar
TLSH 37641242630EC18ACFEE5736E4B2110443FCEF0BB45AAF5A7D89D0C9A6673B165C62C1
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Sending a UDP request
Launching a process
Creating a file
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 23:18:03 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sowdm5uxccldggy5b5hq4nipbwj2crdtamw37r2ctxhcx76kxn6a._file
Verdict:
unknown
Similar samples:
11fc39cf459b554a292a4d4227671f045e5959ecc3e3e13ba1fa06510ac04d4c
njrat
4b883ad70ea161ee562014a3a0280a1d1d8d01f5fd240b89374608f3c05d8692
njrat
596802440276cf7c17a24c0f108f21647579ca06d6bd1299bea1b82d5121afa1
njrat
63e8813f98c05a02ae1c868adf8ca82aabc49e5eadd33368f036440d4116849e
njrat
876e2467c794536214871c18470cbf405ac358baf5e67bb82b2938e7750f438a
njrat
a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5
njrat
b24d44a75e9eead799bb3414d25736c73c172184ba580d19397d1fc7cba3aea2
njrat
c3cd64158186a1d2e0bb0ae12e6b8a4e8a371f59d8c6d80e97d96f8c63c67a55
njrat
ccfcaf33077800cd02c88fa869e9c790bfd843c4c7968e56d4506a346a7c2d24
njrat
cd600fc61127f099c982441726ae13d7937e890f68f4c83d0e25bb3a88b75022
njrat
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201106-1r154qmgrx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
MD5 hash:
26fe571c0c34e3e5d13196275ce27dfb
SHA1 hash:
41b2e6b01e660cd86a75c2f4ab33e2c2583795cd
Link:
https://www.unpac.me/results/bb9952d8-346e-4b78-88fd-854436a7cfa4/
SH256 hash:
c1b27c94e66d85e4527cb168443f56226339652f19eeac7a34098ba4521c78fa
MD5 hash:
ac5c6c5ee42da09cbedab2633748a30b
SHA1 hash:
5ee3dd8b8c9391f9ffbcf6a2ef46573b32fc907f
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/bb9952d8-346e-4b78-88fd-854436a7cfa4/
Parent samples :
93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
SH256 hash:
4ed29cb98055620eb95ec13859a24ca7f40e5e7ac7a513f5a2d1d0bbc3405ed7
MD5 hash:
d7637cbb33ec9ad3751d838096b3ae62
SHA1 hash:
e4ce99f4270866207c8316ba9c18136d2b6601ee
Link:
https://www.unpac.me/results/bb9952d8-346e-4b78-88fd-854436a7cfa4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments