MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 535d9ea8428481430462dacdbbe737d35a97ac4ee6ac42f077cf4ab596d4bc84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 535d9ea8428481430462dacdbbe737d35a97ac4ee6ac42f077cf4ab596d4bc84
SHA3-384 hash: 5d1a78659b29d71f4f23d269cac99fd25d8cf0b764dd086a4e2f658fdbe34b890e70a7dd37317ba2bdb757746769f083
SHA1 hash: 3aaabb3ac0be960f426c18fec9202fab1adb232e
MD5 hash: 02469a459f90ac53ad1bda318d5185ee
humanhash: eighteen-sixteen-sweet-eleven
File name:Cn0JKKY3.exe
Download: download sample
Signature njrat
Create hunting rule
File size:29'184 bytes
First seen:2020-03-29 14:22:39 UTC
Last seen:2020-03-31 08:53:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:QpJ5kx0cGkl/pV63yLJsgAzfmLcWpt+OrZ6VIVuSwgivOSpeDMNETXJXieBve21E:QpJgfiCItWpt+cA9eSI9DMW9q
Threatray 50 similar samples on MalwareBazaar
TLSH 09D2296CB7E24461C17C15FD4A72DA2117B5D0035623EA6E0EE474EB1BA3BC94E8ADF0
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/Cn0JKKY3

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-29 14:35:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=knoz5kccqsaugbdc3lg3xzzx2nnjplco42wef4dxz5fllfwuxsca._file
Verdict:
malicious
Similar samples:
289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
njrat
55b8b84b624767c78a3ba733e577c4bdcd41fe9efa691725376a74077314e436
njrat
884ef8d4d49a6c98b25f93302c1f5d56ba1bfcf73364ee0e641d94c5b300deef
njrat
88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
njrat
b19df7069dc2884dc94026608f9fd4bd3f0f2543802c41dc19b78474c866d2e6
njrat
b7ae7f4453b062073d68146727f16af5d57d39758fd3f0fd7c067ba78eb27b97
njrat
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
njrat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
njrat
d6969e5a50e04cb9bc0a97c3e6dd22d48580bb22f9408d3fc905882d45fcd01b
njrat
ee922b6d10fed127ef2be15c74e0cdfcc18d4bb7ef8a27c34b3ff34e6c492bd9
njrat
+ 40 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/Cn0JKKY3
  
Link
https://pastebin.com/raw/b5UjPxub

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments