Extracted

• • Target

    120fc4b8089f3e0b8c37cc6fe99527a4.exe

  • Size

    81KB

  • MD5

    120fc4b8089f3e0b8c37cc6fe99527a4

  • SHA1

    0223c0f378a2121522739c96264e76245d8c34f2

  • SHA256

    a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7

  • SHA512

    a3450d5ff51ff1f2ad9e735d9478c6efc21c5ccd1eb68434287fc81465dc9ed4457a79766e0f34384453fc74544dd394be07a4c542df2be8876b09713407f32a

  • SSDEEP

    1536:bWPv13GIJ+cbqWvhzCeJtjxPwFV1FJi1oDb/twZyBiGVvdLuwoSjBH:bWP6ceWvhzJP2woftwQiGhdywoI

  Score

  10^/10

  modiloadernjrathackedevasiontrojanpersistence

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • ModiLoader Second Stage

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2