MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b
SHA3-384 hash: b42b0d3488a01e2fc1626a9166568f05fb85e974d0f70fcf99a9b4cb36bd82a85c7e68771987697957c542b9e48dbc6b
SHA1 hash: 9ded66bd4353a94f9d4f014f72603e54559300fb
MD5 hash: a9649fee9e3e73f0c9cc2ecd65b83341
humanhash: oven-spring-indigo-low
File name:BemHr1wh.exe
Download: download sample
Signature njrat
Create hunting rule
File size:44'032 bytes
First seen:2020-03-19 14:32:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:7ZyBRWlQ5GoyybTlt69MO6M9HHtrl9D9O5UE5QzwBlpJNakkjh/TzF7pWnuUgre/:1RmolybT7ob/ZwvQO+Ps+L
Threatray 46 similar samples on MalwareBazaar
TLSH 6713D78CB784A174D5FF8BF1A492B2890B719017A906D30FD9F154D94FB3AC09A11EE7
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/BemHr1wh

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Njrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/1848/
Detection(s):
Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-19 18:27:18 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=assnibivw54qho4uokybvl4vd4czenuzszs6qr5gmdwztwjjw6fq._file
Verdict:
malicious
Similar samples:
28f39e656758b6c40db049e40bbfe958a7a20a754ea6531ccca3e4fdb8dcc66a
njrat
5276b591cc35064bcf552fbd676416e4b8c4c0cfce0e0cec7da9703bdd9fccb1
njrat
610c374d9fcc17102ba7dc8ee3ec5cb569c60d0e86f25b004dfe8d24781f8310
njrat
87c0e0f48bb2599f74c15f8f9e4d3bc96befad82a33de62f89d3bc76d546d8cd
njrat
9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0
njrat
b3ea819ddfabf3e2060d9f8116e0952654d5bcdb5716f84ad142a6ab979b521a
njrat
b4bbfec518b34f417680149af477857ce1a27aa23eaceb4eb99d62230e376ba9
njrat
c2a645b457a4ba814aa0c116f2a501176531ce29d32a695c45c5022d6aabb271
njrat
c6d93ae492f6a2b687c64cc388cf0a483f44428b843c5b384c156f018a2cf63c
njrat
e2136c8268bb5be4fe2a295a9bb9250c00437452cd3d65822290e3a68b1fb94b
njrat
+ 36 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04a4d40515b77903bb9472b01aaf951f059236999665e847a660ed99d929b78b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/BemHr1wh
Cape
Cape
https://www.capesandbox.com/analysis/1848/
Cape
Cape
https://www.capesandbox.com/analysis/1846/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments