MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47990f5090073f082d15cd09b259f1c7e8481ea70c99238f4a87afd94f9e9b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47990f5090073f082d15cd09b259f1c7e8481ea70c99238f4a87afd94f9e9b7
SHA3-384 hash: 5b9546023fbb0961681caebe26e989170bc3328db1215293b66d536a90780873371dc31c5e911066d4c051d0c8ba718e
SHA1 hash: 5f7652e374fc74794502518af352375d2ad41439
MD5 hash: 9fa9f4bf25a868b8204bfb0ea026fba0
humanhash: king-twelve-mango-uranus
File name:rfq00092.rar
Download: download sample
Signature njrat
Create hunting rule
File size:243'543 bytes
First seen:2020-11-09 16:07:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:CD9ub+z7KGSOmULzGaPTBIosuJv9XKAGFbnMtFuKs1Wl:om+zWGT3GIdIxmJYnMtFu71Wl
TLSH 8934232ABD342B2D968258CB6074D7414072AAA84E79C3575CB29FD4C90FD99D0FEFC2
Reporter abuse_ch
Tags:NjRAT rar RAT


Avatar
abuse_ch
Malspam distributing njrat:

HELO: topnewsemaillist.info
Sending IP: 64.188.28.27
From: Brendan Osthuzen <sales@topnewsemaillist.info>
Reply-To: mcsylva007@yandex.ru
Subject: Please Update us on this Order
Attachment: rfq00092.rar (contains "rfq00092.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.21373.14492.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47990f5090073f082d15cd09b259f1c7e8481ea70c99238f4a87afd94f9e9b7/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 14:51:53 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r4zb5ijabz7bawrltijwjm7dr7ijapkodezeohuvb5p3fhz5g3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e47990f5090073f082d15cd09b259f1c7e8481ea70c99238f4a87afd94f9e9b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

rar e47990f5090073f082d15cd09b259f1c7e8481ea70c99238f4a87afd94f9e9b7

(this sample)

njrat

Executable exe ff25936286221005b27254e316c0622a3e828791a2988c163613475263127c0f

  
Dropping
MD5 b18a815ebb7d8f397768ac09edd202bc
  
Dropping
njrat
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff25936286221005b27254e316c0622a3e828791a2988c163613475263127c0f

Comments