Overview

overview

10

Static

static

10

8473acde4d...0f.exe

windows7-x64

8

8473acde4d...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8473acde4d3267b07e41f8eacdda17761b2a0d828d3a7cbaeab2bcab304d250f

  • Size

    437KB

  • Sample

    221126-cdarbsdd53

  • MD5

    6494493746d95598cb1e64b1ed53669c

  • SHA1

    12ed5c845c0b5818c5e7a6c5ff14d007ab50d546

  • SHA256

    8473acde4d3267b07e41f8eacdda17761b2a0d828d3a7cbaeab2bcab304d250f

  • SHA512

    3999294178e5b66961a372d43e0e3d978c79b0375fefe1eca22cfd92dec6c4f8382ad558472147702b5fd1e28decf8e2f328df6c4b2c7c5196c35922b9aec313

  • SSDEEP

    12288:1u5+hCo1m1HOPDq2Owbfjkx0ZkYLt9VkrefM:1e+11m1HOrZbfjpkYLt9erefM

Score
10/10
modiloadernjratevasionpersistencetrojan

Malware Config

Targets

    • Target

      8473acde4d3267b07e41f8eacdda17761b2a0d828d3a7cbaeab2bcab304d250f

    • Size

      437KB

    • MD5

      6494493746d95598cb1e64b1ed53669c

    • SHA1

      12ed5c845c0b5818c5e7a6c5ff14d007ab50d546

    • SHA256

      8473acde4d3267b07e41f8eacdda17761b2a0d828d3a7cbaeab2bcab304d250f

    • SHA512

      3999294178e5b66961a372d43e0e3d978c79b0375fefe1eca22cfd92dec6c4f8382ad558472147702b5fd1e28decf8e2f328df6c4b2c7c5196c35922b9aec313

    • SSDEEP

      12288:1u5+hCo1m1HOPDq2Owbfjkx0ZkYLt9VkrefM:1e+11m1HOrZbfjpkYLt9erefM

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks