Overview

overview

10

Static

static

1

924c015a8f...b9.vbs

windows10-2004-x64

10

924c015a8f...b9.vbs

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    924c015a8f0331ab2173d2db5ae5112924ba97b68b42deb71015e6210196fdb9.zip
  • Size 58KB
  • Sample251124-17js4awqar
  • SHA256 9b17257a6ac0d7a57da4791411498aa99ec1b3065bf44720c819d851a65dc379
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
modiratdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target
      924c015a8f0331ab2173d2db5ae5112924ba97b68b42deb71015e6210196fdb9.vbs
    • Size 223KB
    • SHA256 924c015a8f0331ab2173d2db5ae5112924ba97b68b42deb71015e6210196fdb9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryexecutionmodiratpersistencerat

    • Detects MoDiRAT

    • MoDiRAT

      MoDiRAT is a RAT written in C#.

      ratmodirat

    • Modirat family

      modirat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks