MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebda3d0f42a337880c4b2d262730986e20abcfda2b66f6d91f0ec82d5607552d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebda3d0f42a337880c4b2d262730986e20abcfda2b66f6d91f0ec82d5607552d
SHA3-384 hash: 3253a8b5e51c231b3c7dfcb6dd5b89fc8dc7bcd0a7601b10d494af155c2509e696ad9fa669e4dc10738e8aeeb0bb3c29
SHA1 hash: 9b7919d1be1af1abfc3f2320a77e8d3e53f79890
MD5 hash: 56dcdd392d970cbfddfe1df75684b417
humanhash: high-pasta-yankee-texas
File name:MMNdAHPC.exe
Download: download sample
Signature njrat
Create hunting rule
File size:303'104 bytes
First seen:2020-03-24 10:26:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:pzc8e/ZuLbpM5aqRabSqL6ihUEPjJe5TfGwLP3gsSc4kP165bzrtuL/tMrgQN0xU:XbS8rPjJeBLPEc4kSzwL+rgQN64TX
Threatray 47 similar samples on MalwareBazaar
TLSH 6C5450F0EFF5B969F41C6172BD61047C66C32EAADCD4512AC08FF10625328F685EA85B
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/MMNdAHPC

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Bladabindi-6044420-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 14:11:52 UTC
AV detection:
28 of 30 (93.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pnd2d2cum3yqdclfutcomeynyqkxt62fntpnwi7b3ec2vqhkuwq._file
Verdict:
malicious
Similar samples:
08c0375aa494984e77ec6a082f10b27cf45f7ca08ad1bf2c4c7d4119d41a88af
njrat
2df8b942572700c36070d92e00830e2962f7c199c21d497df65a55e8248c2301
njrat
329b10943314d1e2013f44dcb3ad15ae390bc5d15cec294592c465075e77a5b7
njrat
61322bfef06e7fda9e84ad05a402f63f3ece7013120081ca2d3cdbfd4cfbc807
njrat
707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058
njrat
bccacb3d4d94bf0ffbe0b2ff26d4de7bdb0b400fbf88ad2894371c066a17480e
njrat
c5d7176d2929750e2c3706f1cf41a356e7bf132ca4fcd994796e9f913b0a2fa3
njrat
cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb
njrat
d7dd8e9fd6df14a7fe0bd6bc01c453105676db1932d1c26497a20c44d99a77e9
njrat
f6bc405db3da4e4df654329c7f4edadffc03a033f29d645ac786bf05e28f5735
njrat
+ 37 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/MMNdAHPC

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments