MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105
SHA3-384 hash: 9da4daea34477d1b5a8d8fbf5075e995a0e9fcb027a9069572e804041b1e5eaf86d6158c88b18ce7f86fb0c68080bc06
SHA1 hash: 4994a1e97445b311d074f302ef8c70f8bc3cdafb
MD5 hash: 32fd4d8c4cb3c7a069bd78fbcc6ceb7c
humanhash: floor-michigan-robin-sixteen
File name:aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105
Download: download sample
Signature njrat
Create hunting rule
File size:2'500'608 bytes
First seen:2021-02-28 07:25:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 24576:20j2MtxLu+z+cMCU0WTPsOw33brfEViSgU4f5Ch9vVzUrWGf6vKBd3DFH3A9k3nF:dbuWLDciDU6sh9v66mtFH3K8OiBvg6
Threatray 71 similar samples on MalwareBazaar
TLSH 76C51956A44E76CBD48E1B74F527CD82697D46B8072408D3AC6C68BDAFA3CC139F6C24
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
713
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105
Verdict:
Malicious activity
Analysis date:
2021-02-28 07:56:31 UTC
Tags:
rat njrat bladabindi
Link:
https://app.any.run/tasks/36c900de-fb5e-4170-a3c1-d95c6088d3ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119964/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Creating a window
Connection attempt
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to change the firewall settings
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/620786
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-28 07:25:37 UTC
AV detection:
24 of 49 (48.98%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vipyg2srxs4eblipwjn4wv34eiiemkj2cl2sum2da7knz2y2oecq._file
Verdict:
malicious
Similar samples:
029a8669597543f16beacbcd8fd0eedb0e2ea51a401e5d88bbbe4ef0d0c410c8
njrat
2d631fe6c1c02c67198648c5f7ae1891262bf277721f664bd6c8ffb0e7d6a681
njrat
38b951946943714900dc29bb01ce025a84e0f52f095e2901e74a509b9499f2c6
njrat
49771de8bcea44c22d54d1eebc9f05ff0d33f66355fbf9dd77e7e891cd062bcc
njrat
6057a10b27aebb92f7d961ce23929dc41579f6da1dcbf28572d8c5f0ffac488b
njrat
632315695bf3d61c6249ddf215df529aa5459840e1ad75a388c6af06f7acc99c
njrat
7c53cf8628e9d03bde5397b41277ee48b963122bc3d6ed0a090ee0908c04023d
njrat
87b9f4d3b13c5e4d0a5241193c672472c0fc84126a7c91672fae462f83eb2d2a
njrat
87fd1a37f56e55cc20cdf882955d9ac37a857bd0bf12c480ea76f9a452438ab6
njrat
b99887f1364955d2872bedadab15a15a51429ec8aeb111859d50e24a9fd31342
njrat
+ 61 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/210228-elpc5ek25x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks BIOS information in registry
Identifies Wine through registry keys
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105
MD5 hash:
32fd4d8c4cb3c7a069bd78fbcc6ceb7c
SHA1 hash:
4994a1e97445b311d074f302ef8c70f8bc3cdafb
Link:
https://www.unpac.me/results/cd4c8ab0-546d-474a-b5da-e93f895e80b2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa1f836a51bcb840ad0fb25bcb577c221046293a12f52a334307d4dceb1a7105

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:RAT_njRat
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects njRAT
Reference:http://malwareconfig.com/stats/njRat
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/119964/

Comments