MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62a5cd1fc65cdb2b773565e9861a48f139ee961156b38e26016c28a23fc896cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62a5cd1fc65cdb2b773565e9861a48f139ee961156b38e26016c28a23fc896cc
SHA3-384 hash: d7a027083faa95c773e52d17a4e965544f049554657d48e2805f2da8be62d465024ef5189bce30f7d55696525eaca3ef
SHA1 hash: a2e1afcce39924a3573aa6fdbe808c30589a04a4
MD5 hash: fc23590f9194fb1377259c79495cb78c
humanhash: magazine-venus-butter-florida
File name:99WXCtNq.exe
Download: download sample
Signature njrat
Create hunting rule
File size:37'888 bytes
First seen:2020-03-27 01:39:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:byGBkiyRnDNGRn5IyUvoIdf1hg/SuswcrAF+rMRTyN/0L+EcoinblneHQM3epzXY:OZ5M5jUvtdAaufcrM+rMRa8Nuf+t
Threatray 43 similar samples on MalwareBazaar
TLSH A4032A4D7FE18168C5FD197B05B2D41207BAE04F6D23D90E8EF564AA37636C18F50AE2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/99WXCtNq

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 02:35:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mks42h6gltnsw5zvmxuymgsi6e465fqrk2zy4jqbnqukep6is3ga._file
Verdict:
malicious
Similar samples:
250cfc3bf5271e6a5cdd6ebe240865bf2f960c877590b679c878181b42f85341
njrat
25f59abfbdb775126b69112b260fae983e35bd6da0e6e13ad8fc7343da8540ec
njrat
5947d6a7fc4014628b957c4ed8ffff7c961f37f155cb814224a89e1f3700f060
njrat
abafeafa173768d556241bb6797fc4555b2358ce8d0dfdd81bab9f5f152c077f
njrat
b3a40e1d85f1e1608acf07414a8dea2730c0de0d824bc6165856b8fe00e8ed3d
njrat
ba38f08588d75d7ffd054253f4afd1d9803c2c0f5f390f35214c0b552840793d
njrat
dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64
njrat
e7e5f0ac865dd8cec6539a3defbd09f15df7822b647fcd2e2f53555be98ad8e2
njrat
ed34d4eba0bc7d434f32bb9bca0147632592656ddf0c2aa892fbee54b0850ff1
njrat
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d
njrat
+ 33 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/99WXCtNq

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments