MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed272a73e61d3ddc0f6d70e54387bb7f07821ebbf91dfa6fde536c5c1dabfc2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed272a73e61d3ddc0f6d70e54387bb7f07821ebbf91dfa6fde536c5c1dabfc2e
SHA3-384 hash: 92222a3f5fabdc1bdb8bcc9e839df16e4049c1b907367acbd576f8005d2c9800981615154fe82c3cc318e4d9b14d01f7
SHA1 hash: 5f0b3341558e6ce7f1a7fdf79d488009c3cdea1e
MD5 hash: f78db7a03c115e678a2447b9f4f7f454
humanhash: michigan-winter-fruit-tango
File name:rG9vBxUV.exe
Download: download sample
Signature njrat
Create hunting rule
File size:24'064 bytes
First seen:2020-03-25 04:37:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:1zcqbCK0l4h7o9SVyDGvENDh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZBd:1I30py6vIxaRpcnuc
Threatray 340 similar samples on MalwareBazaar
TLSH 7AB21A4F3FB98856C57C177486A5965003B0A1870423EE2FCDC564CBAFB3AD92D48AF9
Reporter johannes
Tags:NjRAT


Avatar
viql
njrat via https://pastebin.com/raw/rG9vBxUV

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.B-468
Create hunting rule

Win.Trojan.Ratenjay-1
Create hunting rule

Win.Trojan.Bladabindi-6192388-0
Create hunting rule

Win.Trojan.Generic-6417450-0
Create hunting rule

Win.Trojan.Generic-6454614-0
Create hunting rule

Win.Trojan.Generic-6454615-0
Create hunting rule

Win.Packed.Bladabindi-6804148-0
Create hunting rule

Win.Packed.Bladabindi-6917466-0
Create hunting rule

Win.Dropper.njRAT-7436651-0
Create hunting rule

Win.Packed.Generic-7672854-0
Create hunting rule

Win.Packed.Generic-7672855-0
Create hunting rule

Win.Packed.njRAT-7672853-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bladabindi
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 15:29:22 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5utsu47gdu65yd3nodsuhb53p4dyehv37eo7u366knwfyhnl7qxa._file
Verdict:
malicious
Similar samples:
3b0fd1cd0eb83c48df1472510556295bb1a7552deb4f935a340043a0208829ca
njrat
48a33e9cc2edf9c3b9069b89644ff882624292692824be9218a995655458341b
njrat
56fff985f854a691d88f7775e85b4b8b822b5e17d9d52accecf70e6978ce124e
njrat
5b650ef6be4143cad97601ad536b42b14a35340a9b180dabf981f3347fa14a98
njrat
7b5fb3577e72b0b475c14e6be21d12ba40187709f11834f9de0bd5ba696b8e5e
njrat
7f151047bf16651dc37450231277d5190f7af1bad7db6b173705b3cdeb3071df
njrat
806662974bbcbfcdbb239012fb781860d4b84f6e95af9fe5f6f39d1e1fd02d19
njrat
83aaa5321d2adc81e9d5326970437de8c85105298e5ab34de6c892c4e385c18e
njrat
b3df70770623cd714096a8652b3bd2f381e9b7bb26f387933bc2e65f61b4f7cb
njrat
c5b7facb1053e87d655699925bdd6391b047aea6740e26be0806240212419a5f
njrat
+ 330 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/rG9vBxUV

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments