MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303
SHA3-384 hash: 8744f8541e28da28013642224189a8fc08f1ab08b41297fe562603213ef07ea68d86de1bce3b3da01bc88de82a9725e7
SHA1 hash: b24f4b08cf73da046421ec55b2520b1e89e9400b
MD5 hash: 25d8edcbfc7380216bb0ef29d66e8ff1
humanhash: maryland-saturn-oklahoma-comet
File name:PO #KV18RE001-A5871.pif.exe
Download: download sample
Signature njrat
Create hunting rule
File size:153'088 bytes
First seen:2021-09-21 19:05:36 UTC
Last seen:2021-09-21 20:09:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 3072:WU1dsbRjH0ScSqHXHl8g6s+yq4fUQKp4xHNf:WU3sljH0ScSqHXlp+yq4fU9p4xN
Threatray 15 similar samples on MalwareBazaar
TLSH T1BEE32A117289EB13CD2A79390C52259873B79BC73753DA0B3FCDE6B95543B8B4B18222
Reporter abuse_ch
Tags:exe NjRAT RAT


Avatar
abuse_ch
njrat C2:
202.55.132.213:1993

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
202.55.132.213:1993 https://threatfox.abuse.ch/ioc/224344/

Intelligence

File Origin
# of uploads :
2
# of downloads :
490
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO #KV18RE001-A5871.pif.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 19:11:26 UTC
Tags:
trojan rat njrat bladabindi
Link:
https://app.any.run/tasks/79735fcd-c8f6-4916-94e6-559195ee53da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189957/
Detection(s):
SecuriteInfo.com.MSIL.TrojanDownloader.Agent.IVB.26701.15650.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c132386-7f5e-49b7-a9cf-b16861250e41
Result
Threat name:
Njrat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/855141
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses netsh to modify the Windows network and firewall settings
Yara detected Njrat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 18:02:12 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7sla5gg64yugsj2albslruhxarhlkja7h2csh6yynzcggpve4mbq._file
Verdict:
unknown
Similar samples:
4b8bfe706b4f3df2d6e4519ad6c6da01d46124e9bec4f26dff3a3435e5490685
njrat
52bbd5f868a0a36d7f3ef1d675a8553414cf5057bf2b99b871fec5bcf0720122
njrat
69ed72dbf7e4439552b1e07760f02b1f005e6b6529c6666a8a971a0baa556fa8
njrat
98a0f70bad8b8d6877acaa0ae9d7e70127126e815db3ac71ae3492309114b6be
njrat
9c241da391f641a5c4fabc87d324a8d2eab9cc9eced7368db9af5d946df811aa
njrat
f8fb3109639b476089103cd8a0afe01d3f015453c25ecb4f46bf1be8f8b04579
njrat
+ 5 additional samples on MalwareBazaar
Result
Malware family:
njrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat evasion suricata trojan
Link:
https://tria.ge/reports/210921-xr3dqachgp/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies Windows Firewall
njRAT/Bladabindi
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Unpacked files
SH256 hash:
fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303
MD5 hash:
25d8edcbfc7380216bb0ef29d66e8ff1
SHA1 hash:
b24f4b08cf73da046421ec55b2520b1e89e9400b
Link:
https://www.unpac.me/results/89f660f0-ee0d-4cee-bec2-d344cc9e4bac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189957/

Comments