Overview

overview

10

Static

static

10

7156d13a23...d8.exe

windows7-x64

8

7156d13a23...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7156d13a234822f1eaa71c6569259e167935e0222aa03445dafe1901a10a57d8

  • Size

    405KB

  • Sample

    221126-cdcwpadd55

  • MD5

    7af03069fd2115cacf8f083f630d1518

  • SHA1

    0bc4fc8a383cabfd6c02c135cf09771a7abcbf97

  • SHA256

    7156d13a234822f1eaa71c6569259e167935e0222aa03445dafe1901a10a57d8

  • SHA512

    4d6968c35bef582715e22f3ac32fbe8b01e29443e4343701ff92c282890a800f16e64233ab422c106765a12928b92060a8e2c2ada48c85eedc9638c30d814c2b

  • SSDEEP

    12288:7u5Snj11m1HOPDq2Owbfjkx0ZkYLt9VkrefM:7eS51m1HOrZbfjpkYLt9erefM

Score
10/10
modiloadernjratevasionpersistencetrojan

Malware Config

Targets

    • Target

      7156d13a234822f1eaa71c6569259e167935e0222aa03445dafe1901a10a57d8

    • Size

      405KB

    • MD5

      7af03069fd2115cacf8f083f630d1518

    • SHA1

      0bc4fc8a383cabfd6c02c135cf09771a7abcbf97

    • SHA256

      7156d13a234822f1eaa71c6569259e167935e0222aa03445dafe1901a10a57d8

    • SHA512

      4d6968c35bef582715e22f3ac32fbe8b01e29443e4343701ff92c282890a800f16e64233ab422c106765a12928b92060a8e2c2ada48c85eedc9638c30d814c2b

    • SSDEEP

      12288:7u5Snj11m1HOPDq2Owbfjkx0ZkYLt9VkrefM:7eS51m1HOrZbfjpkYLt9erefM

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks