MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54e8e80ccea30e0e8e884cf4b73d2451f83ce74512f9e41eacbd12ff1097df34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54e8e80ccea30e0e8e884cf4b73d2451f83ce74512f9e41eacbd12ff1097df34
SHA3-384 hash: 24fbe04ff7434fb6efbdc5012f0b2b265e303aa0cb523017c3c22b17ae5ffa344c3a907fdf1c6816c2a2fec0b413f4c3
SHA1 hash: c5a5d68d8706c84a6b18b40b00a08f0eec26f1df
MD5 hash: fa22ea3de6f0612c47d942cfdd2f203d
humanhash: double-failed-lemon-mockingbird
File name:bMkBw89X.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'768 bytes
First seen:2020-03-16 06:53:00 UTC
Last seen:2020-03-16 07:06:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 384:el3kcQnkUoSsJGG5ZfB3yIwt4U3Qu0/7FTgPtTFAqzmNsSij:eWcQneSwP5ZRs4U3CeEsv
TLSH 9FE23A5B77E58225C57D06F888B703245372E3878932EB9B5CDC58CA5FA33E40152EE9
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/bMkBw89X

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.njRAT-7445143-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-16 11:01:00 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktuoqdgoumha5duijt2lopjekh4dzz2fcl46ihvmxujp6eex342a._file
Verdict:
suspicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54e8e80ccea30e0e8e884cf4b73d2451f83ce74512f9e41eacbd12ff1097df34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/bMkBw89X
  
Link
https://pastebin.com/raw/2Y942dXK

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments