MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa89c2845bab972074a66caa306d6b39319c9dbdc94aecb004243bc674cd8255. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa89c2845bab972074a66caa306d6b39319c9dbdc94aecb004243bc674cd8255
SHA3-384 hash: 41291285dc5b0ec8eadf376deb2e7d326ec57bf39313a9079571886c4b9271081e38351136eec460159cb216374e0b65
SHA1 hash: 92c6a3945b8d4df8cfe467db0a27acc01cab2f12
MD5 hash: f6ae1ee5084b02ede6ba7d58779a0149
humanhash: king-bulldog-gee-princess
File name:monday.rar
Download: download sample
Signature njrat
Create hunting rule
File size:358'668 bytes
First seen:2020-10-19 10:09:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:IvTy3tVn18ZU7Fg3/CUFm7EWyd1xOZVFnLx9dL49tba+GKj9cjdm8dhHqB4:IvTy3aZU7Fgvl87Sd/CVFnLxO8+DcY81
TLSH DA7423F7900B5F99270064109E5F7AD483C2A65E9AB675EDC04ECC2F720BECCDA46678
Reporter abuse_ch
Tags:NjRAT rar RAT


Avatar
abuse_ch
Malspam distributing njrat:

HELO: mrnewsemaillist.info
Sending IP: 106.75.21.253
From: sales@mrnewsemaillist.info
Reply-To: chrisfasai@yandex.ru
Subject: Re:Re completed
Attachment: monday.rar (contains "monday.exe")

NjRAT C2:
64.188.28.27:5551

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.21007.28889.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa89c2845bab972074a66caa306d6b39319c9dbdc94aecb004243bc674cd8255/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 09:33:06 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ke4fbc3volsa5fgnsvda3llheyzzhn5zffozmaeeq54m5gnqjkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa89c2845bab972074a66caa306d6b39319c9dbdc94aecb004243bc674cd8255

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

njrat

rar fa89c2845bab972074a66caa306d6b39319c9dbdc94aecb004243bc674cd8255

(this sample)

njrat

Executable exe b85e964144a64d78fc54b4e6bae83ba6e1c7179f0a820f361c27f58842b6940a

  
Dropping
MD5 3b2ad70cd2c1320e6a1a15680330684f
  
Dropping
njrat
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b85e964144a64d78fc54b4e6bae83ba6e1c7179f0a820f361c27f58842b6940a

Comments