MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9c2b424ec3247e4b7a2f1affdaace6bd39223767b0a8af4a2dc92543e20479c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

njrat

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	b9c2b424ec3247e4b7a2f1affdaace6bd39223767b0a8af4a2dc92543e20479c
SHA3-384 hash:	0f6ccd8038da9f3293f880b92f88b46b13d453f94a432e139700b17f2f85997b8b23b4319317fa0630cd5e0f76761941
SHA1 hash:	316365ddcedf87917fe374582d524d941104cf79
MD5 hash:	d8eeb77eaf4b1e621a5bc63adc809c6d
humanhash:	music-river-bulldog-louisiana
File name:	YmL62AW9.exe
Download:	download sample
Signature	njrat Create hunting rule
File size:	32'768 bytes
First seen:	2020-10-16 09:02:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	384:50bUe5XB4e0XDOfOLsw0Q0mS03AWTxtTUFQqzF0ObbR:CT9Buak555d2bR
Threatray	37 similar samples on MalwareBazaar
TLSH	F3E208067BE94215D6BC1AFC8CB313214772E3438532EB6F5CDC98CA4B676D00655EE9
Reporter	pmelson
Tags:	exe NjRAT

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Njrat

Link:

https://www.capesandbox.com/analysis/71878/

Detection(s):

Win.Packed.njRAT-7445143-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

DNS request

Connecting to a non-recommended domain

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Result

Threat name:

Njrat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/493309

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Njrat

Behaviour

Behavior Graph:

Download SVG

Detection:

njrat

Link:

https://mwdb.cert.pl/sample/b9c2b424ec3247e4b7a2f1affdaace6bd39223767b0a8af4a2dc92543e20479c/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2020-10-16 09:04:05 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xhblijhmgjd6jn5c6gx73kwonpjzei3wpmfiv5fc3sjfiprai6oa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201016-nr5ysqxaj2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

b9c2b424ec3247e4b7a2f1affdaace6bd39223767b0a8af4a2dc92543e20479c

MD5 hash:

d8eeb77eaf4b1e621a5bc63adc809c6d

SHA1 hash:

316365ddcedf87917fe374582d524d941104cf79

Link:

https://www.unpac.me/results/94e9fb9d-1035-4acd-b872-c721b857756e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NJRat

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b9c2b424ec3247e4b7a2f1affdaace6bd39223767b0a8af4a2dc92543e20479c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.