MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a42ec09d5fcab03929ce3d0240cbc14f104c357c930fb2843521071df4827366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a42ec09d5fcab03929ce3d0240cbc14f104c357c930fb2843521071df4827366
SHA3-384 hash: d0903f13bded790b3cda631eea7f5d33fd9f6b0aaeac942c111a2d05cbf00535176c1e8a2d370b523e42cb80eae32289
SHA1 hash: 10e5916c2ccc76eef2acdd71fff3b4f369bd543c
MD5 hash: 4f6d41b79b64d4bddc543376ba9e9db9
humanhash: snake-texas-salami-july
File name:FEra1afM.exe
Download: download sample
Signature njrat
Create hunting rule
File size:29'696 bytes
First seen:2020-03-14 16:33:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:CPYs5l7VL9skVQ42BkkH5RYIGGmqDq9VXeXbGBsbh0w4wlAokw9OhgOL1vYRGOZj:Cf7/skCXkmsIQq+VXeaBKh0p29SgRNJ
Threatray 240 similar samples on MalwareBazaar
TLSH 7DD21A1937B94916C8BC0B74C431962756F486032553DFBFDDC1A8DA9FA32E8294CBE1
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/FEra1afM

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Packed.Bladabindi-7086597-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-14 21:37:00 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uqxmbhk7zkydskoohubebs6bj4ieynl4smh3fbbveedr35econta._file
Verdict:
malicious
Similar samples:
02df79a95ca91898b809871d3e9efa617146cadd6fb57a97056fb9b6622f62f4
njrat
31a51475efa61899f9136416538b6c0b008131dd8e7cb75aadcd306c66afcb8a
njrat
918f9caeebb7bb5faea1014a288eb2010e07100dd5303aae002368c50dac370f
njrat
9fc7649eec8fc91ad58d27badae903fce1dff83804a830b3606db194c232d653
njrat
ac937327e25a96c0b3c79dfe0e8467444c87691910e0d90d89c81c9f830b0b02
njrat
b748c37f14082e151acc4c6677f19cdcd2cd26b6a8c7d6e768a090e8aecbb698
njrat
dbfb2fb740f0e4b05acc6074c798e65a6aa5ff8c9a8b7bed8f640aa1cd4153c7
njrat
dca1d9c848c823c2a06e7e4108c0b89c91b4f08a0909c91e537a060eba25b788
njrat
ece291548741cfa88e0924aecf93cb1fbff986e8e7f5eecf222c01004fff2670
njrat
fb9b901516c88bfb84fc1142e6da07616ed0a20bfebbccf84076a119a4f704ba
njrat
+ 230 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a42ec09d5fcab03929ce3d0240cbc14f104c357c930fb2843521071df4827366

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/FEra1afM

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments