MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f66ba3c9a85a0a54242aa2a905df2120305cec66efbc9a1a02db3c66ff50b722. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 9
| SHA256 hash: | f66ba3c9a85a0a54242aa2a905df2120305cec66efbc9a1a02db3c66ff50b722 |
|---|---|
| SHA3-384 hash: | 43d7cce406499c701ae4db200de093256554278abe72fd8bb56f5a1f502eb6ac516c59e43893d9ce6eb724d624d23ec9 |
| SHA1 hash: | 38c02175c1cd6abd2374bd0c12157d7395de4f36 |
| MD5 hash: | 5611852a2a2746a6c52b68189619a528 |
| humanhash: | hawaii-thirteen-double-river |
| File name: | f66ba3c9a85a0a54242aa2a905df2120305cec66efbc9a1a02db3c66ff50b722 |
| Download: | download sample |
| Signature | njrat |
| File size: | 350'126 bytes |
| First seen: | 2021-02-28 07:06:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 3072:w5PWNgiqLeg0sSETm6VeV3B5m/F4SO3ZOOEY2ODCQOz32yd:YOe9/1mxV3XPS8EIM2yd |
| Threatray | 57 similar samples on MalwareBazaar |
| TLSH | 57747B027688D711C46421B689DBC27817E4AE8B5A73C61B3FCC7F9F3A31392AD0565B |
| Reporter |  JAMESWT_WT |
| Tags: | NjRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
njRat
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Detected njRat
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Status:
Malicious
First seen:
2021-02-26 08:02:00 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 47 additional samples on MalwareBazaar
Result
Malware family:
njrat
Score:
10/10
Tags:
family:njrat evasion trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Modifies Windows Firewall
njRAT/Bladabindi
Unpacked files
SH256 hash:
572ac1807d7bf08e3a25837a27bc08af7abffb4e8c1016801e24ab81c9c79925
MD5 hash:
ebff06526552f2a2ff20b2c5b6acd976
SHA1 hash:
de4740f162722aa8c6a05a1fe111b1357d8b591a
SH256 hash:
5c2e588094d8080f49b3eefd7a4e86452ebec8f2e21a691cdf4ac2e5239d72c1
MD5 hash:
523f06bbca131b5e5fc60407044e596f
SHA1 hash:
c748d474bbb5188c01be74e99802061d2881aab0
Detections:
win_njrat_w1
win_njrat_g1
SH256 hash:
f66ba3c9a85a0a54242aa2a905df2120305cec66efbc9a1a02db3c66ff50b722
MD5 hash:
5611852a2a2746a6c52b68189619a528
SHA1 hash:
38c02175c1cd6abd2374bd0c12157d7395de4f36
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.