MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bffa8c77d1dac6b0b0af3c5653a5190ea5d0bc0c0b22f44237bfd66bf351a0d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bffa8c77d1dac6b0b0af3c5653a5190ea5d0bc0c0b22f44237bfd66bf351a0d6
SHA3-384 hash: 1385aa3b566cdf57022cc74c2d8d86867c3bfaf85cdb6172adc70f62d4c2baa94883d28148af3667853c3de8962f79e2
SHA1 hash: 7de5f08d2eaa9db24aa7bb99dc3def1a3884d3b5
MD5 hash: 4d0cc2e822c308dea6c2cd78978afd5e
humanhash: seventeen-mountain-harry-triple
File name:bffa8c77d1dac6b0b0af3c5653a5190ea5d0bc0c0b22f44237bfd66bf351a0d6
Download: download sample
Signature njrat
Create hunting rule
File size:12'051'968 bytes
First seen:2020-11-10 11:10:02 UTC
Last seen:2024-07-24 21:05:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 94400fe3e62cd2376124312fe435b8e4 (5 x DCRat, 4 x RemcosRAT, 3 x njrat)
ssdeep 196608:pAv5TstCRhS5RW52osuhGi5U7MlrWHOdW57t9gf0UB8yZiRPowGMZa8I:avat+I5g5llv3I2W50ftiyYFowVa8
Threatray 31 similar samples on MalwareBazaar
TLSH 8CC6336DD19F8067D55CB63F2266E6FF4909DEDCA823801B0DC83EA7F779A1094B2052
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-1346944
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bffa8c77d1dac6b0b0af3c5653a5190ea5d0bc0c0b22f44237bfd66bf351a0d6/
Threat name:
Win32.Trojan.Dorv
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:12:47 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x75iy56r3ldlbmfphrlfhjizb2s5bpambmrpiqrxx7lgx42rudla._file
Verdict:
malicious
Similar samples:
04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b
njrat
20aa773ce4d4e0709faeba02937cc789c114e726f6336c1dcd6c206f00514af2
njrat
5276b591cc35064bcf552fbd676416e4b8c4c0cfce0e0cec7da9703bdd9fccb1
njrat
610c374d9fcc17102ba7dc8ee3ec5cb569c60d0e86f25b004dfe8d24781f8310
njrat
83fda1582e8aa614098d944606a562589f0880c105ef011b0e8b68bf90354da3
njrat
87c0e0f48bb2599f74c15f8f9e4d3bc96befad82a33de62f89d3bc76d546d8cd
njrat
b4bbfec518b34f417680149af477857ce1a27aa23eaceb4eb99d62230e376ba9
njrat
ccefaff00ce5d029e3ac220ce7a0ae2aa4a852c4e7c342910069474469ed78ed
njrat
d6f0bfa0aa9e2b9004d36f51fff20f947adbaa6bbb7fffdde1fc37d105fa7257
njrat
eb086d6c54841616485b2ad99ed2e2e2ebc21f01e6c5a58611ac914f70b5042f
njrat
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201110-bsgyzh7mc2/
Unpacked files
SH256 hash:
bffa8c77d1dac6b0b0af3c5653a5190ea5d0bc0c0b22f44237bfd66bf351a0d6
MD5 hash:
4d0cc2e822c308dea6c2cd78978afd5e
SHA1 hash:
7de5f08d2eaa9db24aa7bb99dc3def1a3884d3b5
Link:
https://www.unpac.me/results/cd9ff50b-b0a4-4875-976f-c0eec648108b/
SH256 hash:
9c1d8bbf53f8b89b8070c8ff57fb507184042dbba3800d6c6fee4d10bf617540
MD5 hash:
dd71b8ff13c281eb07428673ac79820f
SHA1 hash:
971e151b21a3e692859f47f9b94178931f53fa5e
Link:
https://www.unpac.me/results/cd9ff50b-b0a4-4875-976f-c0eec648108b/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments