MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6969e5a50e04cb9bc0a97c3e6dd22d48580bb22f9408d3fc905882d45fcd01b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6969e5a50e04cb9bc0a97c3e6dd22d48580bb22f9408d3fc905882d45fcd01b
SHA3-384 hash: 349feb497e8d1c9a55fb3a2af97c6437183f7537ffa89c3ab0c44d739520d993fb0eb06234b78377c18e1d296793a767
SHA1 hash: f71aa274df5efcef9d9ba7ec495ebc3c6a28f334
MD5 hash: a8e941ccb2b638965e8f77f2bfca18b0
humanhash: september-dakota-nebraska-bulldog
File name:jHp5W81c.exe
Download: download sample
Signature njrat
Create hunting rule
File size:32'256 bytes
First seen:2020-04-01 08:58:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 768:qHDN4sptfHCzxtOeoIHavelzvCXQmIDUu0tis4Vj:ciAaPJcQVksVj
Threatray 32 similar samples on MalwareBazaar
TLSH 9EE22B6DFBE64466D1BC0AB54571950053B8E003E523F77E4ECA24E62B2B7D84B84DF2
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/jHp5W81c

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 09:35:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22lj4wsq4bgltpaks7b6nxjc2scybozc7fai2p6jawec2rp42anq._file
Verdict:
malicious
Similar samples:
1b735b93727cab4992aff0f4e2905ab57f0e3189b25cc164fb422685e6af70c7
njrat
289bb9f2125f62945f3960f0fe72381aea008539b1c6ea29a81ad66bd2f247a9
njrat
50291fb5edd36f2d5a467e0beed36433f35a118e220984afb775924135a62e20
njrat
55b8b84b624767c78a3ba733e577c4bdcd41fe9efa691725376a74077314e436
njrat
884ef8d4d49a6c98b25f93302c1f5d56ba1bfcf73364ee0e641d94c5b300deef
njrat
88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
njrat
b19df7069dc2884dc94026608f9fd4bd3f0f2543802c41dc19b78474c866d2e6
njrat
b7ae7f4453b062073d68146727f16af5d57d39758fd3f0fd7c067ba78eb27b97
njrat
c66a4d352ed249cafe427728b6c8d4eda8da23c6bef48f993beb236a6c765f35
njrat
ccae475b281127a3280a51906a2ab50248c8b7f75c34e93c5bd62ccc0fded850
njrat
+ 22 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/jHp5W81c

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments