MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a0738251e550466cd8d44fb9ca97084752d2175506865aef28a2bb93f5407b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a0738251e550466cd8d44fb9ca97084752d2175506865aef28a2bb93f5407b4
SHA3-384 hash: 958d419b1bcbc5d394035daa834570ba3221ae2f03d2998d72f3814de7088b402ea5dd4d0940a356e415195ac12bbac6
SHA1 hash: e677166d0eaf3ccd3d5d40e76c192172a67f0aff
MD5 hash: a6c196524cf991c2adc199dd689031ba
humanhash: cold-emma-zulu-delta
File name:HtNjD98d.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'256 bytes
First seen:2020-03-27 08:15:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 768:5kkv+xW1nRNAzx7SnQFOvAFLhv6MQmIDUu0tiUUCj:ik62adRLQVkXj
TLSH 1AE21AADFBEA4466D1BD0AB50571950017B4E103E523F77E4ECA24A62B2F2D84B84DF2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/HtNjD98d

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 08:35:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
40 of 47 (85.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=didtqji6kucgntmnit5zzklqqr2s2ilvkbugllxsriv3sp2ua62a._file
Verdict:
malicious
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/HtNjD98d

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments