MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1
SHA3-384 hash: 839a65e528cb794e77c1f21f620ee7c6e24fb388d180e06c3716c0f841671bbd778bf198e804a6e70d73a1193b48baf1
SHA1 hash: 793a859b8de0c26c29c9d9b51637f3eb0db4b122
MD5 hash: 624115db5496a695953473c3c541baca
humanhash: hot-music-july-aspen
File name:624115db5496a695953473c3c541baca.exe
Download: download sample
Signature njrat
Create hunting rule
File size:343'040 bytes
First seen:2021-06-16 13:47:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:4Jd5MFC7QqXl1IeSFW4C61L3fOU7Tm+EFdF+As1izwaSY/x3aPQGVqi:BFuX3IeSFr9p3fO0TvQF81cwa9/taPOi
Threatray 71 similar samples on MalwareBazaar
TLSH 5E7412075B888262C0C803B11965D3759770AE769B12C67B7DC4BF0F7EBA3831A476E9
Reporter abuse_ch
Tags:exe NjRAT RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://maizefucanism.hopto.org/
Verdict:
Malicious activity
Analysis date:
2021-06-16 12:56:48 UTC
Tags:
opendir rat nanocore
Link:
https://app.any.run/tasks/63c24660-e62f-4c19-932d-832bf9f0c688

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2af09b87-4167-4a73-bc75-c59fb5a52bcb
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/803095
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Process Start Without DLL
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 11:31:50 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w36lmz72u76wk3kqfoywcyx6zqqlph2igadqmhclxbkd5a2jt3aq._file
Verdict:
unknown
Similar samples:
0a8ddf7be1e8bcaefd7fca87ee9adc6aabd53dee30c69b726beb0554b1746c6d
njrat
0cae975d5c602437ef781f39605c9a79fe0c0bca956bd4fecb21e17ace1c58ca
njrat
0ed95818ba222ec8d2ae4fdaaed1b143d9faada09c27a6c8aaecb8aa5ceb270f
njrat
2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf
njrat
5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5
njrat
610d9028a1aac20684ad5bf0b6c0212016eceb3d6d4563cead3c398aac441c5b
njrat
a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
njrat
b1adf30c5cb4c1a7c06e877308d0f0e32f6ea1b21105de5db7583a889d089373
njrat
b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7
njrat
bf81bf5e34c04aed363d975f7d3c8af217349011ee1083d3f50b71de885b4847
njrat
+ 61 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210616-praprpdzqj/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
46cc8e0c790351f231d07a27bb3608486fcbfb58fb3c69bb1c828732d1c48cf4
MD5 hash:
8b0bc6cc7cd7bada8597e4dfeb91d7ae
SHA1 hash:
f74ff9fcceeca80d6341a3a22b3c1d91294c221d
Link:
https://www.unpac.me/results/7c2c308d-76df-49f4-98c7-7bfbbe86a3a6/
SH256 hash:
27b0ea5504ea0d6cb8cfdf9cf7824ab50e0b4e2f1834d105e1071671c5b43ccc
MD5 hash:
3928f29ec9ddb1459088839aebc5f8cb
SHA1 hash:
762925f10fdfba7706b035bbe4a609925430ea3a
Link:
https://www.unpac.me/results/7c2c308d-76df-49f4-98c7-7bfbbe86a3a6/
SH256 hash:
0aa714f3548e674ad65e723363a13ceebaaaccb8c191feae9398772027dee1ce
MD5 hash:
8e39b0a25c71a2a1794064034a5a9c37
SHA1 hash:
51940a29db2515f9c28e300e6a82d0a45bb88691
Link:
https://www.unpac.me/results/7c2c308d-76df-49f4-98c7-7bfbbe86a3a6/
SH256 hash:
b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1
MD5 hash:
624115db5496a695953473c3c541baca
SHA1 hash:
793a859b8de0c26c29c9d9b51637f3eb0db4b122
Link:
https://www.unpac.me/results/7c2c308d-76df-49f4-98c7-7bfbbe86a3a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:pe_imphash
Create hunting rule
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1365028/
  
Delivery method
Distributed via web download

Comments