MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3bb77a17e54a662b6fed76d2537ad3a27ec2ab051f913a9aa1207219d96c30f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3bb77a17e54a662b6fed76d2537ad3a27ec2ab051f913a9aa1207219d96c30f
SHA3-384 hash: 89fcb65178f4515b433dbc0af96ed6438f8a62ae8b2c3e59434075913699886b50dd98895dd9ee3b2e32a3959a4fc317
SHA1 hash: 570e7f9ebfb73988257e2c3fe557c0976abdba52
MD5 hash: 5c0f588e85e044f37830641df53720be
humanhash: december-lemon-fifteen-happy
File name:pXGkMSn5.exe
Download: download sample
Signature njrat
Create hunting rule
File size:37'888 bytes
First seen:2020-03-23 10:03:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 384:3+jjUngibpjpPu7w9qyMT2dPBgsGmkxbrAF+rMRTyN/0L+EcoinblneHQM3epzXK:uj4NN9ZMT2dGlmYrM+rMRa8Nub8t
Threatray 35 similar samples on MalwareBazaar
TLSH 22033A4D7FE1816CC5FD157B05B2D01207BAE14F6E23D90E8EE6649A37736C48B50AE1
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/pXGkMSn5

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 03:57:46 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wo5xpil6kstgfnx625wskn5nhit6ykvqkh4rhknkcidsdhmwymhq._file
Verdict:
malicious
Similar samples:
16d8aa3dae24ba03bbc22093b96c73b303646cd7fb9829a857177c0cbe2ca724
njrat
250cfc3bf5271e6a5cdd6ebe240865bf2f960c877590b679c878181b42f85341
njrat
25f59abfbdb775126b69112b260fae983e35bd6da0e6e13ad8fc7343da8540ec
njrat
62a5cd1fc65cdb2b773565e9861a48f139ee961156b38e26016c28a23fc896cc
njrat
abafeafa173768d556241bb6797fc4555b2358ce8d0dfdd81bab9f5f152c077f
njrat
b3a40e1d85f1e1608acf07414a8dea2730c0de0d824bc6165856b8fe00e8ed3d
njrat
ba38f08588d75d7ffd054253f4afd1d9803c2c0f5f390f35214c0b552840793d
njrat
dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64
njrat
ed34d4eba0bc7d434f32bb9bca0147632592656ddf0c2aa892fbee54b0850ff1
njrat
f0caf48005d504dfb402e3ef4b137187e9ffa0d903099222560d7f4a8885358d
njrat
+ 25 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/pXGkMSn5

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments