General
-
Target
swift 0182021.xls
-
Size
215KB
-
Sample
210111-3dceba2h9j
-
MD5
d5185ca33c490e907fc4fa6b22558890
-
SHA1
151f729d65c4241ccde8e7055b57d1176d29198d
-
SHA256
eaa14ff5cdf3ec428bd1b0c2689272996741a4c93f3c1289934057c3c5cafc78
-
SHA512
b214da4e9284615faebdd60fd45f8f161aabc06428ac40f0cd8ec83a870dd225dfbe9795a6d8e1e192734f748a92b5d7da6f436325e8de60ed4e46fcd41dcbbf
Static task
static1
Behavioral task
behavioral1
Sample
swift 0182021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
swift 0182021.xls
Resource
win10v20201028
Malware Config
Extracted
lokibot
http://worldpackmx.com/fretyuil/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
swift 0182021.xls
-
Size
215KB
-
MD5
d5185ca33c490e907fc4fa6b22558890
-
SHA1
151f729d65c4241ccde8e7055b57d1176d29198d
-
SHA256
eaa14ff5cdf3ec428bd1b0c2689272996741a4c93f3c1289934057c3c5cafc78
-
SHA512
b214da4e9284615faebdd60fd45f8f161aabc06428ac40f0cd8ec83a870dd225dfbe9795a6d8e1e192734f748a92b5d7da6f436325e8de60ed4e46fcd41dcbbf
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage
-
ServiceHost packer
Detects ServiceHost packer used for .NET malware
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-