MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7ae7f4453b062073d68146727f16af5d57d39758fd3f0fd7c067ba78eb27b97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7ae7f4453b062073d68146727f16af5d57d39758fd3f0fd7c067ba78eb27b97
SHA3-384 hash: 8ee64db7539b9d6d72f66dd0aef73179d535af6add0a64333a0a08bf1b52818d277d535e8a56c8b61508a80780ce19b4
SHA1 hash: 4d9937790ab611e229192421d789d3a1ec80bcc8
MD5 hash: 544281857067c2a6f123416f8b8fea9c
humanhash: one-kansas-quebec-lamp
File name:rMQX7MSi.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'256 bytes
First seen:2020-03-27 05:49:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:yVaxirnp7VJMzxn6zQJyRm3dPlvyYQmIDUu0ti6mtj:P0pKakJnQVkEj
Threatray 31 similar samples on MalwareBazaar
TLSH FCE21AADFBE64466D1BD0AB50571950013B8E003E523F77E4ECB24A62B2B7D84B84DF2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/rMQX7MSi

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 06:35:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
42 of 47 (89.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6xh6rctwbraoplicrtsp4lk6xkx2olvr7j7b7l4az52pdvspolq._file
Verdict:
malicious
Similar samples:
1b735b93727cab4992aff0f4e2905ab57f0e3189b25cc164fb422685e6af70c7
njrat
289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
njrat
50291fb5edd36f2d5a467e0beed36433f35a118e220984afb775924135a62e20
njrat
55b8b84b624767c78a3ba733e577c4bdcd41fe9efa691725376a74077314e436
njrat
884ef8d4d49a6c98b25f93302c1f5d56ba1bfcf73364ee0e641d94c5b300deef
njrat
88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
njrat
b19df7069dc2884dc94026608f9fd4bd3f0f2543802c41dc19b78474c866d2e6
njrat
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
njrat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
njrat
d6969e5a50e04cb9bc0a97c3e6dd22d48580bb22f9408d3fc905882d45fcd01b
njrat
+ 21 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/rMQX7MSi

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments