MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e
SHA3-384 hash: 45456e766f0fb6a6b84c376636140710d94499c61742d3cd25b309ca5260b3246db88257c4cd47ee540b89e4b7e47a22
SHA1 hash: 5a342ed6755dc395215956143a54bcc4e42b97e7
MD5 hash: 45586ab9fada3f0335af9c963a4cc5d5
humanhash: carpet-enemy-winner-double
File name:8vm39x_Payment_Receipt.vbs
Download: download sample
Signature njrat
Create hunting rule
File size:513 bytes
First seen:2021-11-28 07:42:13 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12:TaVLMUVb9wCPayBmq/4S8oR0wfLIFny8ZNLOBH0TC:mV4UvXCK5wS8m0wj+nDZNLOBHcC
Threatray 3'931 similar samples on MalwareBazaar
TLSH T1DEF0681FEC1BFBC722221523F0D3803C84F4C1CA4E680D6CA02B494C47508BDB9610BA
Reporter abuse_ch
Tags:NjRAT vbs


Avatar
abuse_ch
Payload URLs:
https://transfer.sh/get/8uvh1y/frt.txt
https://transfer.sh/get/kwX55w/rfg.txt

Intelligence

File Origin
# of uploads :
1
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VB.Trojan.Valyria.5575.22604.32641.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/61a33308bbfd2af97cb6e248/reports/f59219fa-1ec4-4084-b8c9-0196e16be729/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Nanocore njRat BitRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/897296
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in alternative data streams (ADS)
Detected Nanocore Rat
Detected njRat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sigma detected: NanoCore
Sigma detected: Suspicious PowerShell Command Line
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses dynamic DNS services
Uses netsh to modify the Windows network and firewall settings
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected BitRAT
Yara detected Nanocore RAT
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 529774 Sample: 8vm39x_Payment_Receipt.vbs Startdate: 28/11/2021 Architecture: WINDOWS Score: 100 50 jamcav.duckdns.org 2->50 52 1120bitratnew.duckdns.org 2->52 66 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->66 68 Multi AV Scanner detection for domain / URL 2->68 70 Found malware configuration 2->70 72 14 other signatures 2->72 10 wscript.exe 1 2->10         started        13 jsc.exe 2->13         started        15 jsc.exe 2->15         started        17 jsc.exe 2->17         started        signatures3 process4 signatures5 80 VBScript performs obfuscated calls to suspicious functions 10->80 82 Wscript starts Powershell (via cmd or directly) 10->82 19 powershell.exe 14 20 10->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        process6 dnsIp7 54 transfer.sh 144.76.136.153, 443, 49756, 49763 HETZNER-ASDE Germany 19->54 74 Creates an undocumented autostart registry key 19->74 76 Writes to foreign memory regions 19->76 78 Injects a PE file into a foreign processes 19->78 29 jsc.exe 19->29         started        34 jsc.exe 19->34         started        36 jsc.exe 19->36         started        38 conhost.exe 19->38         started        signatures8 process9 dnsIp10 56 1120bitratnew.duckdns.org 29->56 58 1120bitratnew.duckdns.org 185.244.30.13, 1120, 49779, 49784 DAVID_CRAIGGG Netherlands 29->58 60 192.168.2.1 unknown unknown 29->60 44 C:\Users\user\AppData\Local:28-11-2021, HTML 29->44 dropped 84 Creates files in alternative data streams (ADS) 29->84 86 Uses netsh to modify the Windows network and firewall settings 29->86 88 Modifies the windows firewall 29->88 90 Hides threads from debuggers 29->90 62 legend4000.duckdns.org 192.3.121.222, 4000, 49854 AS-COLOCROSSINGUS United States 34->62 46 C:\ProgramData\XXX\Microsoft.Exe, PE32 34->46 dropped 92 Protects its processes via BreakOnTermination flag 34->92 94 Creates an autostart registry key pointing to binary in C:\Windows 34->94 40 netsh.exe 34->40         started        64 jamcav.duckdns.org 185.244.30.6, 49829, 49832, 49835 DAVID_CRAIGGG Netherlands 36->64 48 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 36->48 dropped 96 Hides that the sample has been downloaded from the Internet (zone.identifier) 36->96 file11 98 Uses dynamic DNS services 56->98 signatures12 process13 process14 42 conhost.exe 40->42         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e/
Threat name:
Script-WScript.Downloader.Nemucod
Create hunting rule
Status:
Malicious
First seen:
2021-11-28 07:43:08 UTC
File Type:
Text (PowerShell)
AV detection:
15 of 28 (53.57%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ogaq3pavyjw3u6p6modxyrihug6k7i6vqzygylmak5fbkqcs6ha._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
njrat
Create hunting rule
Similar samples:
03e5f5529c62c94e1216b6fdb248c8e94fa1d28b4a1b2317df31c281423fb826
njrat
414a79e6c87489cb73e9176e867d554788a28ba86cb4e00f3f8fed15400999bd
njrat
51af4d4e1af93fd32fd240a7ec9df52e2af9f7d7567c7f7dff776ce0b4852323
njrat
704e26dbdebc8b3ad1391f5b9d671f8b9550609455821540151ff70e17bed798
njrat
881003326302ab243f71138e2e39517677c9117fd73e50f8989ee9b39e86407b
njrat
9d077371cd1d6dc2b8b337d0bc978afb1e910a947bb0e14c15a37c70c745704c
njrat
a8130d6e0367f83f68640720c35d12b339c1a84e371cff73524fcaa0fc62f44c
njrat
+ 3'921 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:bitrat family:nanocore family:njrat botnet:hacked evasion keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/211128-jj9aeabgd7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Blocklisted process makes network request
Modifies Windows Firewall
UPX packed file
BitRAT
BitRAT Payload
NanoCore
njRAT/Bladabindi
Malware Config
C2 Extraction:
jamcav.duckdns.org:6746
Dropper Extraction:
https://transfer.sh/get/8uvh1y/frt.txt
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fb8c086de0ae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/1827655/

Comments