MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763
SHA3-384 hash: e163464e148b04a74328c4f049b8ef6291af832eb707266f523f15018e7de3b32a44184d064e090cf557645f50c8dc33
SHA1 hash: dd6c67b4683663bde2d6d451ae666a597f785a40
MD5 hash: 034a52fc02e9c56763a18719835a5320
humanhash: enemy-september-venus-north
File name:fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763
Download: download sample
Signature njrat
Create hunting rule
File size:3'340'800 bytes
First seen:2020-06-29 07:09:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2339ac77bf9371500ebbf86df3a10d43 (8 x njrat, 4 x LgoogLoader, 3 x RedLineStealer)
ssdeep 98304:Aviz/27qWGq/TzuqCDl2Ptao7jBOmYcNs:Aviq75/Tzuf38Ns
Threatray 328 similar samples on MalwareBazaar
TLSH 19F5334072C8023FC1B513B120FD23571BE8FCB15375E78BA0C661DE595A4D2AABBB96
Reporter JAMESWT_WT
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
njRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15470/
Detection(s):
Win.Malware.Generic-6895514-0
Create hunting rule

SecuriteInfo.com.BackDoor.Generic19.BMJZ.21232.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763/
Threat name:
Win32.Backdoor.SpyGate
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 02:05:37 UTC
File Type:
PE (Exe)
Extracted files:
765
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7qh73jcoe5elijddtikzenlmyie2x5qelkgwubu7l5lc5iptc5rq._file
Verdict:
malicious
Similar samples:
02df79a95ca91898b809871d3e9efa617146cadd6fb57a97056fb9b6622f62f4
njrat
31a51475efa61899f9136416538b6c0b008131dd8e7cb75aadcd306c66afcb8a
njrat
918f9caeebb7bb5faea1014a288eb2010e07100dd5303aae002368c50dac370f
njrat
9fc7649eec8fc91ad58d27badae903fce1dff83804a830b3606db194c232d653
njrat
a42ec09d5fcab03929ce3d0240cbc14f104c357c930fb2843521071df4827366
njrat
ac937327e25a96c0b3c79dfe0e8467444c87691910e0d90d89c81c9f830b0b02
njrat
b748c37f14082e151acc4c6677f19cdcd2cd26b6a8c7d6e768a090e8aecbb698
njrat
dbfb2fb740f0e4b05acc6074c798e65a6aa5ff8c9a8b7bed8f640aa1cd4153c7
njrat
dca1d9c848c823c2a06e7e4108c0b89c91b4f08a0909c91e537a060eba25b788
njrat
ece291548741cfa88e0924aecf93cb1fbff986e8e7f5eecf222c01004fff2670
njrat
+ 318 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence evasion
Link:
https://tria.ge/reports/200629-24ftsltf4x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Modifies service
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15470/

Comments