modiloader | b62974737cde4fd82e8c918815ba5af11a4bb7c7b4af2d1680c88e5fcb77f1c1 | Triage

Sharing

General

Target

b62974737cde4fd82e8c918815ba5af11a4bb7c7b4af2d1680c88e5fcb77f1c1
Size

1.2MB
Sample

221128-xn29jshd38
MD5

2938f0df9c213f6b72ad810dd344280c
SHA1

51a6efa00cfd118fe2926bdae1ed941032693490
SHA256

b62974737cde4fd82e8c918815ba5af11a4bb7c7b4af2d1680c88e5fcb77f1c1
SHA512

d5d4f4e33a4a40b0a1482f973fc11ddf4c9dd06b04328e1cb1dd5cab341496e7f3fe2bf3560eac58224ed87ee783d075ab349e792ec97411420d4a2c6d1ac9e3
SSDEEP

24576:RJ/Nr0n4WncacV5NBMwxVFLB+uoQxs2eBS:RPKGjNawxsbQpmS

Score

10^/10

modiloader njrat te7chelou by xfacker evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

te7chelou by xfacker

C2

127.0.0.1:5552

Mutex

c633d68267ddc65598b821619897acab

Attributes

reg_key
c633d68267ddc65598b821619897acab
splitter
|'|'|

Targets

- Target
  
  b62974737cde4fd82e8c918815ba5af11a4bb7c7b4af2d1680c88e5fcb77f1c1
- Size
  
  1.2MB
- MD5
  
  2938f0df9c213f6b72ad810dd344280c
- SHA1
  
  51a6efa00cfd118fe2926bdae1ed941032693490
- SHA256
  
  b62974737cde4fd82e8c918815ba5af11a4bb7c7b4af2d1680c88e5fcb77f1c1
- SHA512
  
  d5d4f4e33a4a40b0a1482f973fc11ddf4c9dd06b04328e1cb1dd5cab341496e7f3fe2bf3560eac58224ed87ee783d075ab349e792ec97411420d4a2c6d1ac9e3
- SSDEEP
  
  24576:RJ/Nr0n4WncacV5NBMwxVFLB+uoQxs2eBS:RPKGjNawxsbQpmS
Score

10^/10

njrat te7chelou by xfacker trojan evasion persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratte7chelou by xfackertrojan

behavioral2

njratte7chelou by xfackerevasionpersistencetrojan