Overview

overview

10

Static

static

3

2026-09-04...ar.exe

windows10-2004-x64

7

2026-09-04...ar.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-04_442e1ca969ec94e2a8549837c734ce0c_cobalt-strike_elex_glassworm_icedid_njrat_vidar
  • Size 991KB
  • Sample260905-ptjemacm4v
  • SHA256 3fe43f7477b6da4963b02151d796f8c63575ac99c4d32031360daf6d9ef93769
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njratdefense_evasionpersistencetrojan

Malware Config

Targets

    • Target
      2026-09-04_442e1ca969ec94e2a8549837c734ce0c_cobalt-strike_elex_glassworm_icedid_njrat_vidar
    • Size 991KB
    • SHA256 3fe43f7477b6da4963b02151d796f8c63575ac99c4d32031360daf6d9ef93769
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionpersistencenjrattrojan

    • Family: njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks