MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51aed8db193794512a9d60736c06a19890c3e12ff3b0b22ae77832169723debf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51aed8db193794512a9d60736c06a19890c3e12ff3b0b22ae77832169723debf
SHA3-384 hash: 1a7514ba326fe4315fe32d219b290048cc5aa66690f70dc1dbaf2abb8f35e6866a1f2e8b06e0c8490476c3b0818919a3
SHA1 hash: a1e6a712d38384656161c623fc8f8354e012d9ac
MD5 hash: b2e4ddbbe971e8a5e90b7e7374d53d3d
humanhash: blossom-winter-fish-jupiter
File name:kuzAu8Lz.exe
Download: download sample
Signature njrat
Create hunting rule
File size:24'064 bytes
First seen:2020-03-18 11:48:27 UTC
Last seen:2020-03-18 21:36:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:DY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZLb:ML2s+tRyRpcnuM
Threatray 289 similar samples on MalwareBazaar
TLSH F1B22A4E3FA98856C5AC1B7496A6965003B091470423EE3FCCC554CBAFB37DA2D48EF9
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/kuzAu8Lz

Intelligence

File Origin
# of uploads :
14
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Packed.Bladabindi-6804148-0
Create hunting rule

Win.Packed.Bladabindi-6917466-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-18 15:20:00 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgxnrwyzg6kfcku5mbzwybvbtcimhyjp6oylekxhpazbnfzd327q._file
Verdict:
malicious
Similar samples:
237494387c104ddeff1f3b40842da5cd430bf526663c0b10cf2979d8265397fc
njrat
25cfc68958a0cb5232d1e4bb1cddbf70b9494d3ef240337e2cedb9226c786b1c
njrat
553b932611fdb66130ffe51b352b03c487cc0662a2ecf0708e3ddacb620cced0
njrat
703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58
njrat
792fbf337e4d738502dba52638e1c20de4486e092e02f83db77e10ddb0ab448f
njrat
7a8ef2bd1c4b9d15c7f174544a01feb7709164a23e748f9a0f769774243648e7
njrat
957fb8a83836c7891ef2a513d354439776e51c027b908193c9c7df269e42a7a9
njrat
ba27536db363cf3a604908ecd21ca5b81b0b20e3f6f0447628b82e34240ae67a
njrat
c5b7facb1053e87d655699925bdd6391b047aea6740e26be0806240212419a5f
njrat
c96d7a2be148621094eb933be12d8c2bda0ae6f8f7c51dcbeca6ccd2b78ad4c7
njrat
+ 279 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51aed8db193794512a9d60736c06a19890c3e12ff3b0b22ae77832169723debf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/kuzAu8Lz
  
Link
https://pastebin.com/raw/dE6EbhaT
  
Link
https://pastebin.com/raw/YPQ8niN0
  
Link
https://pastebin.com/raw/jCZGjN1Z
  
Link
https://pastebin.com/raw/z7ZfPTmh
  
Link
https://pastebin.com/raw/rCMrLddQ
  
Link
https://pastebin.com/raw/WR90MGTh
  
Link
https://pastebin.com/raw/yU1SaH4C
  
Link
https://pastebin.com/raw/nCHK8ePy
  
Link
https://pastebin.com/raw/dMGKyFgp
  
Link
https://pastebin.com/raw/k5THKNgg
  
Link
https://pastebin.com/raw/AcCfPcpu
  
Link
https://pastebin.com/raw/Qz2gA5LP
  
Link
https://pastebin.com/raw/8Lffkk7N

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments