MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532
SHA3-384 hash: dd67cefd34f1df0b842ba69888b6fd5030f189023991b4b3ab87267bbdbf15862b8152f903486a88aee72056926f7c5c
SHA1 hash: 8d919e1d10a590babbb1e88707f41b5653080cba
MD5 hash: 7578770adaa094d49594be394effcb3b
humanhash: one-hamper-network-echo
File name:8XN2B1_Payment_Receipt.vbs
Download: download sample
Signature njrat
Create hunting rule
File size:552 bytes
First seen:2021-11-29 19:57:09 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12:rVlZoY6aVXaAUzVE4wdMDJ5Y3nLjGTOb5NjyNgLy4OIlC:rVln6aVX5U5EGDMLjywNGNgLy+lC
Threatray 584 similar samples on MalwareBazaar
TLSH T1B5F0AB2ADC04AADE0182ED9BC5E70C6FCD1180861F789529B271C2FF83475CF90AE0AD
Reporter abuse_ch
Tags:NjRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/61a530cfbbfd2af97cbab461/reports/77169cec-3f01-4bcd-a938-bbb34ccf2fac/overview
Result
Verdict:
SUSPICIOUS
Result
Threat name:
Nanocore njRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/898231
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in alternative data streams (ADS)
Detected Nanocore Rat
Detected njRat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Obfuscated command line found
Protects its processes via BreakOnTermination flag
Sigma detected: NanoCore
Sigma detected: Suspicious PowerShell Command Line
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Nanocore RAT
Yara detected Njrat
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 530707 Sample: 8XN2B1_Payment_Receipt.vbs Startdate: 29/11/2021 Architecture: WINDOWS Score: 100 50 jamcav.duckdns.org 2->50 52 1120bitratnew.duckdns.org 2->52 54 prda.aadg.msidentity.com 2->54 68 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 13 other signatures 2->74 10 wscript.exe 1 2->10         started        13 jsc.exe 2->13         started        15 jsc.exe 2->15         started        17 jsc.exe 2->17         started        signatures3 process4 signatures5 82 VBScript performs obfuscated calls to suspicious functions 10->82 84 Wscript starts Powershell (via cmd or directly) 10->84 86 Obfuscated command line found 10->86 19 powershell.exe 14 20 10->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        process6 dnsIp7 56 transfer.sh 144.76.136.153, 443, 49775, 49776 HETZNER-ASDE Germany 19->56 76 Creates an undocumented autostart registry key 19->76 78 Writes to foreign memory regions 19->78 80 Injects a PE file into a foreign processes 19->80 29 jsc.exe 19->29         started        34 jsc.exe 19->34         started        36 jsc.exe 19->36         started        38 conhost.exe 19->38         started        signatures8 process9 dnsIp10 58 1120bitratnew.duckdns.org 29->58 60 1120bitratnew.duckdns.org 185.244.30.13, 1120, 49783, 49801 DAVID_CRAIGGG Netherlands 29->60 62 192.168.2.1 unknown unknown 29->62 44 C:\Users\user\AppData\Local:29-11-2021, HTML 29->44 dropped 88 Creates files in alternative data streams (ADS) 29->88 90 Uses netsh to modify the Windows network and firewall settings 29->90 92 Modifies the windows firewall 29->92 94 Hides threads from debuggers 29->94 64 legend4000.duckdns.org 192.3.121.222, 4000, 49827 AS-COLOCROSSINGUS United States 34->64 46 C:\ProgramData\XXX\Microsoft.Exe, PE32 34->46 dropped 96 Protects its processes via BreakOnTermination flag 34->96 98 Creates an autostart registry key pointing to binary in C:\Windows 34->98 40 netsh.exe 34->40         started        66 jamcav.duckdns.org 185.244.30.6, 49831, 49844, 49861 DAVID_CRAIGGG Netherlands 36->66 48 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 36->48 dropped 100 Hides that the sample has been downloaded from the Internet (zone.identifier) 36->100 file11 102 Uses dynamic DNS services 58->102 signatures12 process13 process14 42 conhost.exe 40->42         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532/
Threat name:
Script-WScript.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-11-29 19:58:09 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 44 (13.64%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfczbcmylbjmgzq5asabbrdgcur3sbgnstzr7msfzj6xlkzcauza._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
njrat
Create hunting rule
Similar samples:
3bf5f251905471ab07782554a58cfa444e4693c4b1ecad16471c489924fd1fe3
njrat
51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323
njrat
704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
njrat
888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529
njrat
ad29674b1a2bcc3ff4ef5746d9317740ab72b016ee3b89ac9aa9871bcb378b6b
njrat
d9f858f28cab427ea59133d06469903d937cd10334a0fdd5f77fe529e3d0ece1
njrat
fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e
njrat
+ 574 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:nanocore family:njrat botnet:hacked evasion keylogger persistence spyware stealer suricata trojan upx
Link:
https://tria.ge/reports/211129-yptjgacfdr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Blocklisted process makes network request
Modifies Windows Firewall
UPX packed file
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Possible NanoCore C2 60B
BitRAT
BitRAT Payload
NanoCore
njRAT/Bladabindi
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Malware Config
C2 Extraction:
jamcav.duckdns.org:6746
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a94590899858/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

Visual Basic Script (vbs) vbs a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments