MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bccacb3d4d94bf0ffbe0b2ff26d4de7bdb0b400fbf88ad2894371c066a17480e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bccacb3d4d94bf0ffbe0b2ff26d4de7bdb0b400fbf88ad2894371c066a17480e
SHA3-384 hash: b04e9922d5b731866ae81a1f22b185647de79f9aa46bb233af00d41f3e48c1a2292d449734e63c38a2bb71ac6d106501
SHA1 hash: bef6515842657510808ca6d2c8c60d173bcead63
MD5 hash: 3bbb5d3b8198403c24a76ecc60edbe65
humanhash: utah-alabama-crazy-mango
File name:RqqGcmdH.exe
Download: download sample
Signature njrat
Create hunting rule
File size:45'056 bytes
First seen:2020-03-25 19:16:57 UTC
Last seen:2020-03-25 19:48:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:IKN0lLm0P1Zd8ZC9HqsxaCt2djpoiMYkaljF:YLX5KkaCtUjuSkG
Threatray 48 similar samples on MalwareBazaar
TLSH 5313C78E63A47D01C27CB3B95536834543F1B68B5C62E79E0CC88DFE0B76714299F6A2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/RqqGcmdH

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Worm.Njrat-2
Create hunting rule

Win.Trojan.B-468
Create hunting rule

Win.Trojan.Bladabindi-6044420-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Dropper.Bladabindi-7565286-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-25 20:49:14 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xtfmwpknss7q767awl7snvg6ppnqwqapx6ek2keug4oam2qxjaha._file
Verdict:
malicious
Similar samples:
08c0375aa494984e77ec6a082f10b27cf45f7ca08ad1bf2c4c7d4119d41a88af
njrat
2df8b942572700c36070d92e00830e2962f7c199c21d497df65a55e8248c2301
njrat
329b10943314d1e2013f44dcb3ad15ae390bc5d15cec294592c465075e77a5b7
njrat
61322bfef06e7fda9e84ad05a402f63f3ece7013120081ca2d3cdbfd4cfbc807
njrat
707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058
njrat
c5d7176d2929750e2c3706f1cf41a356e7bf132ca4fcd994796e9f913b0a2fa3
njrat
cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb
njrat
d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9
njrat
ebda3d0f42a337880c4b2d262730986e20abcfda2b66f6d91f0ec82d5607552d
njrat
f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735
njrat
+ 38 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/RqqGcmdH
  
Link
https://pastebin.com/raw/1URH290U

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments