MALICIOUS — 934_njRAT-v0.6.4.bin

MALICIOUS — 934_njRAT-v0.6.4.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Dynamer family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: f132324acf09c0562a1cad1288bfb4021bd991659126d21ecb9499938bf6acb3
• SHA-1: 1887396650202fc9e10d1044dc40322b2ab46b52
• MD5: 51c2ee936ded2e55f8bcc8cba6e3b330
• imphash: dae02f32a21e03ce65412f6e56942daa
• ssdeep: 192:dNc2iE9ZflPFFiydLz/GQYehDnGUx99Lg5Pjxns0cmd3dMtsl:U2xFi2LTfx96Fs0cmd3dMtE
• TLSH: T1322592C905312B00DA31AE133A75D9FC65939C4DE5B93B994306097A3C34E3B2E6963B
• Submitted as: 934_njRAT-v0.6.4.bin
• File type: pe · Size: 13312 bytes
• Verdict: malicious (91/100) · Family: Dynamer

Detections (4 of 52 engines)

• capa (capabilities): capability:execution/powershell
• Microsoft Defender: Trojan:Win32/Dynamer!ac
• Emsisoft (Emergency Kit): Trojan.MSIL.Agent.CJQ
• Kaspersky (KVRT): Trojan.MSIL.Agent.dzdf

MITRE ATT&CK

• T1059.001
• T1112

Why this verdict

The malicious score of 91/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Dynamer!ac (rule Trojan:Win32/Dynamer!ac) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.MSIL.Agent.CJQ (rule Trojan.MSIL.Agent.CJQ) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.MSIL.Agent.dzdf (rule Trojan.MSIL.Agent.dzdf) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Dynamer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report