General
-
Target
RFQ Valves 664KU.exe
-
Size
1.1MB
-
Sample
201217-2mtas5sgds
-
MD5
3352c3dec270a79c54d41ba24ed4d40a
-
SHA1
24871d56b5af7b56cb06923c07aec98eb8f51e55
-
SHA256
016fa792f8385aa4279c96be727537b054dc89e5f58d1b90f271e37c8cad9c00
-
SHA512
df368f92079ab6600bbf11d31e2d7c2d760a88406caad31823d417fa06d26785295b5c4824e88d4b45dc69de1006f870a19236f43858a7660bf934d28c11a0ab
Static task
static1
Behavioral task
behavioral1
Sample
RFQ Valves 664KU.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
RFQ Valves 664KU.exe
Resource
win10v20201028
Malware Config
Extracted
lokibot
http://gandokiblit.pw/.blessdnewweek/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
RFQ Valves 664KU.exe
-
Size
1.1MB
-
MD5
3352c3dec270a79c54d41ba24ed4d40a
-
SHA1
24871d56b5af7b56cb06923c07aec98eb8f51e55
-
SHA256
016fa792f8385aa4279c96be727537b054dc89e5f58d1b90f271e37c8cad9c00
-
SHA512
df368f92079ab6600bbf11d31e2d7c2d760a88406caad31823d417fa06d26785295b5c4824e88d4b45dc69de1006f870a19236f43858a7660bf934d28c11a0ab
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-