MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
SHA3-384 hash: f8e645ff58c7fb9bd22fc64971fc333d91225f571b65eff89908c92a0f943e608fb811dd4a3a9b9703710f871e68d28b
SHA1 hash: 7d0ad6cf1eca4e026a95586248bd337890a24e21
MD5 hash: c05882507d7270f7c4371f2443597de9
humanhash: kilo-violet-floor-delta
File name:c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
Download: download sample
Signature njrat
Create hunting rule
File size:376'320 bytes
First seen:2020-11-11 11:07:12 UTC
Last seen:2020-11-15 22:49:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:1UJfDI1ekNwDSW50S3Ay7OL+WYWUMpGDoMybJEkZfrLOXtm/wyBeHXOvgN1:W8ekNwhys/xW+KHZy3yBIXl
Threatray 11 similar samples on MalwareBazaar
TLSH 5284F19C7B888957EF7F727194A22A040BB0ED437766C6976A4482EF935F3902D022D7
Reporter seifreed
Tags:NjRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Creating a file
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 01:36:15 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykfkoqh2rny54mgr6dkvh6prodoihz4cueq3qsyweste3dgm5zcq._file
Verdict:
unknown
Similar samples:
13690a4d7ae3acd542c99ab687383cc2d5b8b20346c2035a8f6381b03efbf7cb
njrat
599cf925792d277131ea91b93c908324fd3115e4bda163cae7ab0f44dd3cd263
njrat
5cbcddc6136a4692ec6065f531645033a8ee69aaff25f5a0033fffab705c01a5
njrat
6d5f672d7f0f898fcbd61de854ebb606307557eccfd30b5e0cd76f689da29234
njrat
8c0577ec4537880647e232dc1c3b0c722bb1efc0f8f4ea99729ed3607a1dace2
njrat
a4da992ea98f571b2cfa4603243fc9bca4e7620b195d9020e64da8e8f639d7ec
njrat
c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7
njrat
cc10bb6e07911b422b71a6f0ada6d7fed969c7c7bea26976b86f7ea70a43fa41
njrat
ccc3f57b398f8d8c671c152004ec16ad6646480dd2edc32ff2da50b2c2251bb3
njrat
dc647305de0ae67eff2e86276355bc83aa761b03693459df14d10ae6cd4a3102
njrat
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201111-p1t8pz1a6j/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
MD5 hash:
c05882507d7270f7c4371f2443597de9
SHA1 hash:
7d0ad6cf1eca4e026a95586248bd337890a24e21
Link:
https://www.unpac.me/results/c3783472-3fc9-40c5-b3bf-d08db722134a/
SH256 hash:
f880f5f5c1cc52c654ba8da8fcd65a42221f0956289f8c9198f8381e1aa6ef29
MD5 hash:
8d631d6495a3c7b9639e37bd0bd078b7
SHA1 hash:
56168c35e2590acdb8703c14a99259f46e750f1c
Link:
https://www.unpac.me/results/c3783472-3fc9-40c5-b3bf-d08db722134a/
SH256 hash:
c1b27c94e66d85e4527cb168443f56226339652f19eeac7a34098ba4521c78fa
MD5 hash:
ac5c6c5ee42da09cbedab2633748a30b
SHA1 hash:
5ee3dd8b8c9391f9ffbcf6a2ef46573b32fc907f
Detections:
win_njrat_w1
Create hunting rule
win_njrat_g1
Create hunting rule
Link:
https://www.unpac.me/results/c3783472-3fc9-40c5-b3bf-d08db722134a/
Parent samples :
93ac3676971096331b1d0f4f0e350f0d93a14473032dbfc7429dce2bffcabb7c
c28aa740fa8b71de30d1f0d553f9f170dc83e782a121b84b1624a64d8cccee45
4cbeb41aeb9ee9c5133c7486d11c493d6f5e8f32b908ae6c10ede213f6f8c43b
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:CN_disclosed_20180208_c
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://twitter.com/cyberintproject/status/961714165550342146
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Njrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect njRAT in memory
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:win_njrat_w1
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify njRat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments