MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe66f4f74af20c296630341ec43e562bdc7b48d854aba32bd3ca18efa8a0357c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


njrat


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe66f4f74af20c296630341ec43e562bdc7b48d854aba32bd3ca18efa8a0357c
SHA3-384 hash: 0e26b01e0f333078b888f7aa971d11133ec98af90729f8de4c2f0b0cc412ff7be95aea838048a075349fa02eb03d23d3
SHA1 hash: 5fb8a5af13b5d00cf91c8a0ede8b730e7b971441
MD5 hash: ba7e3c67b62d302b81453b78fa53c190
humanhash: apart-xray-equal-pip
File name:fe66f4f74af20c296630341ec43e562bdc7b48d854aba32bd3ca18efa8a0357c
Download: download sample
Signature njrat
Create hunting rule
File size:456'704 bytes
First seen:2020-03-23 18:48:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'472 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:nBs4/aCRLKZdr3bW605HppM2Tn8f7BcrXa0fLov1:1WZF2cB60
TLSH F5A4B512CCEA6824CC92FAF33661B1F7C33B9E25696C4F0E165D32E7211966139F570A
Reporter Marco_Ramilli
Tags:exe NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 02:08:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ztpj52k6igcszrqgqpmipswfpohwsgyksv2gk6tzimo7kfagv6a._file
Verdict:
unknown
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

njrat

Executable exe fe66f4f74af20c296630341ec43e562bdc7b48d854aba32bd3ca18efa8a0357c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/310863/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments