MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 884ef8d4d49a6c98b25f93302c1f5d56ba1bfcf73364ee0e641d94c5b300deef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 884ef8d4d49a6c98b25f93302c1f5d56ba1bfcf73364ee0e641d94c5b300deef
SHA3-384 hash: 3e4fc1ddf717f56dbc9143a7cb8376bd66f4d6150dd7d91b1b00411cbffb6ec83b375bd20c8d055a9a4fb9bb62f1363c
SHA1 hash: 1fe4fb42b9ef63948adec8cd4411640eac5ceb8d
MD5 hash: d41a78c123e5574d6ad4fe110708107d
humanhash: friend-lamp-butter-oxygen
File name:SBp1cnVq.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'256 bytes
First seen:2020-04-01 06:49:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 768:/5JEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tiqIVj:cD6uukAbiT6oQVk9cj
Threatray 32 similar samples on MalwareBazaar
TLSH B4E22BADFBEA4466D1BC0AB50571950013B4D103E523F77E4ECA24A62B6B7D84B84DF2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/SBp1cnVq

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 07:35:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbhprvgutjwjrms7smycyh25k25bx7hxgnso4dtedwkmlmya33xq._file
Verdict:
malicious
Similar samples:
1b735b93727cab4992aff0f4e2905ab57f0e3189b25cc164fb422685e6af70c7
njrat
289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
njrat
50291fb5edd36f2d5a467e0beed36433f35a118e220984afb775924135a62e20
njrat
55b8b84b624767c78a3ba733e577c4bdcd41fe9efa691725376a74077314e436
njrat
88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
njrat
b19df7069dc2884dc94026608f9fd4bd3f0f2543802c41dc19b78474c866d2e6
njrat
b7ae7f4453b062073d68146727f16af5d57d39758fd3f0fd7c067ba78eb27b97
njrat
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
njrat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
njrat
d6969e5a50e04cb9bc0a97c3e6dd22d48580bb22f9408d3fc905882d45fcd01b
njrat
+ 22 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/SBp1cnVq

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments