MALICIOUS — ba36ce6b0f2cfdf84d018a1ad461810642ecd62a7448a13b688d3e4bb098b1df

MALICIOUS — ba36ce6b0f2cfdf84d018a1ad461810642ecd62a7448a13b688d3e4bb098b1df is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Njrat family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: ba36ce6b0f2cfdf84d018a1ad461810642ecd62a7448a13b688d3e4bb098b1df
SHA-1: 1dad9f8c977954a2e5d5beec5b0e09e5c0cc2614
MD5: 6a85d01d7c025b550cd6247a1baf2ff5
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 768:kdRfZqJ5btavW455CVHfeX/Px8hbxhFDfWHjhEGYu1+Eb8pqaI+zYig0VKNfrx+:kdjt6sN6K
TLSH: T1CC45C989F591236DAA9F1C33C495AE37DD24985A6EB81C771343B7AFF38801F044A189
Submitted as: ba36ce6b0f2cfdf84d018a1ad461810642ecd62a7448a13b688d3e4bb098b1df
File type: pe · Size: 283136 bytes
Verdict: malicious (99/100) · Family: Njrat

Detections (4 of 56 engines)

capa (capabilities): capability:execution/powershell
Microsoft Defender: Trojan:MSIL/CryptInject.MBAI!MTB
Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.10304
Kaspersky (KVRT): HEUR:Backdoor.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:MSIL/CryptInject.MBAI!MTB (rule Trojan:MSIL/CryptInject.MBAI!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Jalapeno.10304 (rule Gen:Variant.Jalapeno.10304) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.MSIL.Agent.gen (rule HEUR:Backdoor.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4224 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

9e459c250943890139d3d4d29964e2ba5763c138efbf058a5706bf27e053e2ae - 9e459c250943890139d3d4d29964e2ba5763c138efbf058a5706bf27e053e2ae
7f534942409308ffc8a8e0f44f0d4b397fd91c92e855a53dd1476ed5b9ea0462 - 7f534942409308ffc8a8e0f44f0d4b397fd91c92e855a53dd1476ed5b9ea0462
7d034f6c11c8fa315298ce4b8e624f8f34eff5ea99747dfca2311bf9ebe4dc7b - 7d034f6c11c8fa315298ce4b8e624f8f34eff5ea99747dfca2311bf9ebe4dc7b
4ef75425021542f379a53f1d16f45978adfcde08dd291fe746a8e77e77d35e36 - 4ef75425021542f379a53f1d16f45978adfcde08dd291fe746a8e77e77d35e36
d14590f02eb69d52aaf8101a3076c1a131898dc4369ef71c8c17367a0ee7ef8e - d14590f02eb69d52aaf8101a3076c1a131898dc4369ef71c8c17367a0ee7ef8e
8262fd5fab3b62961eda328b9116103416717af0a1d62deb4288f0852bcf83a3 - 8262fd5fab3b62961eda328b9116103416717af0a1d62deb4288f0852bcf83a3
830794f1ceaa07ad8c5f01576fc67017f24b9b043b2ebf928c0b7d8f5ec49910 - 830794f1ceaa07ad8c5f01576fc67017f24b9b043b2ebf928c0b7d8f5ec49910
f0231d7b67a11b1161219e9f869019ab20bf6009ba59bbb7459e835834ce23a4 - f0231d7b67a11b1161219e9f869019ab20bf6009ba59bbb7459e835834ce23a4
382292735b72f7473204634509d8a8319048de14b5cc7bcd28cd46c30d4d8849 - 382292735b72f7473204634509d8a8319048de14b5cc7bcd28cd46c30d4d8849
40947b54d5853af7b27738c6dcf8c7473609b1f998d6bcbbaf9285e0235da9ad - 40947b54d5853af7b27738c6dcf8c7473609b1f998d6bcbbaf9285e0235da9ad
48fe1a93bde997fa2181bb9e3bf49150d79893f404fa4f4eaf80d58c54cce902 - 48fe1a93bde997fa2181bb9e3bf49150d79893f404fa4f4eaf80d58c54cce902

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.73.24
4.230.171.124
52.230.59.222
52.110.12.49
52.110.12.18
172.215.188.232
52.148.114.188
52.110.12.28
72.153.5.131
52.110.12.15

More Njrat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report