Overview

overview

10

Static

static

3

fade.exe

windows7-x64

10

fade.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fade.exe

  • Size

    1.1MB

  • Sample

    240923-3ght8a1emr

  • MD5

    8d67939d6dc3b76814097e987d758f17

  • SHA1

    2fb6734a6f6e282d9b427c37d32121ba200cec8a

  • SHA256

    1e1c417f6dcb68c73ccb1bcb969060495bf43159315dd92ece950b06bf2bd808

  • SHA512

    6f960c7a001e6bafa93094c198e9e19b23aabc8133a50b95e9ddabc1577a98aac4871defe6a6544da1e4d79fe1f9f5c8e723d156cf535a29c9f57b102697f9e5

  • SSDEEP

    24576:TFGJXjWqILcBwjkaWaWLNBXIYJsGIJPDeF32LWtzT0Zdakv:TFG17ILcBwjkasC1eXRkok

Score
10/10
njratdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      fade.exe

    • Size

      1.1MB

    • MD5

      8d67939d6dc3b76814097e987d758f17

    • SHA1

      2fb6734a6f6e282d9b427c37d32121ba200cec8a

    • SHA256

      1e1c417f6dcb68c73ccb1bcb969060495bf43159315dd92ece950b06bf2bd808

    • SHA512

      6f960c7a001e6bafa93094c198e9e19b23aabc8133a50b95e9ddabc1577a98aac4871defe6a6544da1e4d79fe1f9f5c8e723d156cf535a29c9f57b102697f9e5

    • SSDEEP

      24576:TFGJXjWqILcBwjkaWaWLNBXIYJsGIJPDeF32LWtzT0Zdakv:TFG17ILcBwjkasC1eXRkok

    Score
    10/10
    njratdiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks