MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c50c2962fbf806d36c4bfcd79fb433490c294bac0c96f94b23d83da0a6c4a5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c50c2962fbf806d36c4bfcd79fb433490c294bac0c96f94b23d83da0a6c4a5a1
SHA3-384 hash: 77ea0b5391afd3ecc947006b7b9939beafa8e7a475e8da20abe28b64456457389ff8e4a3cc1a11299a0ec57f995efd01
SHA1 hash: 2af457561f746628c0216c14eb0c9c9cf7d8ec4a
MD5 hash: 2fba4776c084d6602c5203a2b4e0da64
humanhash: glucose-high-vegan-ack
File name:Ningbo_P.R.China_Quote2020_DiscountOrder906996.rar
Download: download sample
Signature njrat
Create hunting rule
File size:191'967 bytes
First seen:2020-04-10 16:25:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:z6Uqo6+Z5+PgaWZaVEPZGubwVHCA9xlKYxuQg7Z112bweSh+6g7cDzRHj4+IRl5X:WK6MUgaKKEhGu0V/jHoB7ZTO1Y+QzRH8
TLSH 76141231423619437BDDFAA2522023D50864B0FE5F6CE4AF086F596AC178DDA5FC21AF
Reporter abuse_ch
Tags:COVID-19 NjRAT nVpn rar RAT


Avatar
abuse_ch
COVID-19 themed malspam distributing njRAT:

HELO: alhoutisons.com
Sending IP: 62.215.26.86
From: DEGSON-Jerry <degson222@alhoutisons.com>
Subject: RE: Re: Re:( EMAIL ref. 767/19)/COVID-19/Order 20% discount
Attachment: Ningbo_P.R.China_Quote2020_DiscountOrder906996.rar (contains "JPjbDOe.exe")

njRAT C2:
185.140.53.251:4040

Hosted on nvpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-04-10 16:35:20 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 45 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yugcsyx37adng3cl7tlz7nbtjegcss5mbslpsszd3a62bjweuwqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

rar c50c2962fbf806d36c4bfcd79fb433490c294bac0c96f94b23d83da0a6c4a5a1

(this sample)

njrat

Executable exe c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c

  
Dropping
MD5 a3c0d3d0c68fe280721f953443f8cf22
  
Dropping
SHA256 c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c

Comments