popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

client.exe

backdoor njRAT PE32 PE File .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 5, 2024, 10:37 a.m. Aug. 5, 2024, 10:48 a.m.
Size 31.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 88f51d627da1f6fddea62b9f1cc66cbf
SHA256 8601904fb878151c3dfa821f653e529747f50a961854bec78014e9e2ed44b9cc
CRC32 7C611839
ssdeep 768:tnZghV5VXPKzxF+dt+XKvJ+rvaPQmIDUu0tinAj:UfqciMQVkhj
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_njRAT_Zero - Win Backdoor njRAT

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.213.208.196 Active Moloch
144.91.79.54 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 .
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ok.
console_handle: 0x00000007
1 1 0
host 185.213.208.196
host 144.91.79.54
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Generic.lA1H
Elastic Windows.Trojan.Njrat
CAT-QuickHeal Trojan.GenericFC.S20328680
Skyhigh BehavesLike.Win32.BackdoorNJRat.nm
ALYac Gen:Variant.Jalapeno.1929
Cylance Unsafe
VIPRE Gen:Variant.Jalapeno.1929
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 700000121 )
BitDefender Gen:Variant.Jalapeno.1929
K7GW Trojan ( 700000121 )
Cybereason malicious.27da1f
Baidu MSIL.Backdoor.Bladabindi.a
VirIT Trojan.Win32.Dnldr25.DDDI
Symantec MSIL.Trojan!gen2
ESET-NOD32 a variant of MSIL/Bladabindi.AS
APEX Malicious
McAfee BackDoor-NJRat!88F51D627DA1
Avast MSIL:Bladabindi-JK [Trj]
ClamAV Win.Packed.Generic-9795615-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Backdoor:MSIL/Bladabindi.f68f03b9
NANO-Antivirus Trojan.Win32.Gen8.ecsqgn
MicroWorld-eScan Gen:Variant.Jalapeno.1929
Rising Backdoor.njRAT!1.9E49 (CLASSIC)
Emsisoft Gen:Variant.Jalapeno.1929 (B)
F-Secure Trojan.TR/Dropper.Gen7
DrWeb BackDoor.Bladabindi.15771
Zillya Trojan.Bladabindi.Win32.99364
TrendMicro BKDR_BLADABI.SMC
McAfeeD Real Protect-LS!88F51D627DA1
Trapmine malicious.high.ml.score
FireEye Generic.mg.88f51d627da1f6fd
Sophos Mal/Bladabi-D
Ikarus Trojan.MSIL.Bladabindi
Jiangmin TrojanDropper.Autoit.dce
Google Detected
Avira TR/Dropper.Gen7
MAX malware (ai score=80)
Antiy-AVL Trojan[Backdoor]/MSIL.Bladabindi.as
Kingsoft malware.kb.c.1000
Gridinsoft Trojan.Win32.NjRat.tr
Xcitium Backdoor.MSIL.Bladabindi.BA@7oej5x
Arcabit Trojan.Jalapeno.D789
ZoneAlarm HEUR:Trojan.Win32.Generic
GData MSIL.Trojan-Spy.Bladabindi.BQ
Varist W32/MSIL_Bladabindi.A.gen!Eldorado
AhnLab-V3 Trojan/Win32.Bladabindi.R130484
Acronis suspicious
dead_host 192.168.56.103:49193
dead_host 192.168.56.103:49181
dead_host 192.168.56.103:49190
dead_host 144.91.79.54:6522
dead_host 192.168.56.103:49177
dead_host 192.168.56.103:49186
dead_host 192.168.56.103:49174
dead_host 192.168.56.103:49167
dead_host 192.168.56.103:49170
dead_host 192.168.56.103:49191
dead_host 192.168.56.103:49194
dead_host 192.168.56.103:49187
dead_host 192.168.56.103:49175
dead_host 192.168.56.103:49164
dead_host 192.168.56.103:49178
dead_host 192.168.56.103:49171
dead_host 192.168.56.103:49188
dead_host 192.168.56.103:49183
dead_host 192.168.56.103:49184
dead_host 192.168.56.103:49172
dead_host 192.168.56.103:49165
dead_host 192.168.56.103:49179
dead_host 192.168.56.103:49168
dead_host 192.168.56.103:49192
dead_host 192.168.56.103:49180
dead_host 192.168.56.103:49185
dead_host 192.168.56.103:49173
dead_host 192.168.56.103:49176
dead_host 192.168.56.103:49169