MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac87839eae6a814986627c3d72e7b34c6e27bc7cbb310e1997baf1a22a57628e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac87839eae6a814986627c3d72e7b34c6e27bc7cbb310e1997baf1a22a57628e
SHA3-384 hash: 2f4d096bfe4ae5a43f3023f2adb44430a5cb5daf365026dea3d856eaac52d446d8728e664b3b5bf8acd4c64941363141
SHA1 hash: 807ae516f65c3025f9572285edf5398158139975
MD5 hash: d76de6f9b9163da83d11ba4474530c4e
humanhash: edward-south-berlin-violet
File name:ac87839eae6a814986627c3d72e7b34c6e27bc7cbb310e1997baf1a22a57628e
Download: download sample
Signature njrat
Create hunting rule
File size:132'608 bytes
First seen:2020-06-17 09:33:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:UNTxebgyjFO3A0UEtWw7f6VwyH9mw/94Gu55sZ6tkeZQ:UlxeMyjNtw7yVwCyBrFZ
TLSH 84D3DFCDEF9C40E7CEF5BA3D8EB2BD081915852D43D3E6469B49F5900BD2B510A8DA83
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19412/
Detection(s):
PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 19:43:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsdyhhvonkautbtcpq6xfz5tjrxcppd4xmyq4gmxxly2eksxmkha._file
Verdict:
suspicious
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
evasion persistence trojan family:njrat
Link:
https://tria.ge/reports/200624-8wm33vbwvn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Drops startup file
Loads dropped DLL
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19412/

Comments