MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0407c5317cc1ef408223770e68872a159fb14b76266668ccd353d1e150425af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0407c5317cc1ef408223770e68872a159fb14b76266668ccd353d1e150425af
SHA3-384 hash: f179fc80b5518c8bced57e027b408e0393d5073f52ec75713b0982cb0f0f9d081ec49b913037547404d85d7299fe8fa8
SHA1 hash: 7b1550ce0a4b954f6f1031b0dc2847d85a04bbb4
MD5 hash: 92c413fbbc2666e786b7b6bbeea3d006
humanhash: missouri-spaghetti-violet-equal
File name:d0407c5317cc1ef408223770e68872a159fb14b76266668ccd353d1e150425af
Download: download sample
Signature njrat
Create hunting rule
File size:92'160 bytes
First seen:2020-06-17 09:35:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:nUZ1ULEckSOYdfYvldYsDPkwL2VujjxCcqVXRBDFF4oh7Ta96SAZwlfKxrD04:Uz3ZSOYfqdhlYujjUcmR1/4WXPEwL
TLSH 8B93CA2225EF24ADF3739AB21FE5F5FFC929E973150A70BA21801B068735D42AD42375
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19444/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.55143.5708.23743.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.SpyGate
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 19:31:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bahyuyxzqppicbcg5yoncdsufm7wffxmjtgndgngu6r4fieewxq._file
Verdict:
unknown
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:njrat evasion
Link:
https://tria.ge/reports/200624-y8984lt6ge/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies service
Adds Run entry to start application
Loads dropped DLL
Drops startup file
Modifies Windows Firewall
Executes dropped EXE
njRAT/Bladabindi
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19444/

Comments