MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6
SHA3-384 hash: 4b30aa44622f0e13356201918aa3762a3e2e1790aa540277fa8789b7a203969bda8c246e985c27ca112999790310c1e3
SHA1 hash: 706371a5171f9f8c229b64311e868902442a780e
MD5 hash: eb08ef15a82a2884cd1f2c6b9d4064f9
humanhash: oregon-aspen-coffee-glucose
File name:9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6
Download: download sample
Signature njrat
Create hunting rule
File size:1'126'912 bytes
First seen:2021-02-28 07:10:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 113 x njrat, 80 x RedLineStealer)
ssdeep 24576:uFDcN8if+QG7ycQvvwVyYkgtM4LQBCoG6T0yNdzw:u5G8imQwuvwVyCLQB9xw
Threatray 5 similar samples on MalwareBazaar
TLSH EA3533158F1C4EBBD80E3673F25B6299A5584D601FFBAE284DE1F0164C8B17D209AB7C
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6
Verdict:
Suspicious activity
Analysis date:
2021-02-28 07:52:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ee43b992-bcea-41d0-988f-01d13e5f8a3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119814/
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/621123
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6/
Threat name:
Win32.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2021-02-27 06:31:40 UTC
AV detection:
38 of 48 (79.17%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t3tzwqa4zk5gt7l3gumcvyxnqjrsjmpwloudnywetammbtfqnlda._file
Verdict:
suspicious
Similar samples:
36d43440d9562c799d56ab17c32e7afac314394fe65d2df701e507e2963e9e75
njrat
43fc7007823fa8f0e718a782ba2d85a5e63eb77a8efebc223e72d5671465e44f
njrat
526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5
njrat
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
njrat
5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49
njrat
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210228-jag151sxts/
Behaviour
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6
MD5 hash:
eb08ef15a82a2884cd1f2c6b9d4064f9
SHA1 hash:
706371a5171f9f8c229b64311e868902442a780e
Link:
https://www.unpac.me/results/887048ee-04f8-4661-9699-97ae24ff15e0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ee79b401ccaba69fd7b35182ae2ed826324b1f65ba836e2c49818c0ccb06ac6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/119814/

Comments