Description
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
48234a387e7777a7a284acb8f0bfef52.exe
General
Target
Size
Sample
48234a387e7777a7a284acb8f0bfef52.exe
637KB
210408-x16bed3gjn
Score
10 /10
MD5
SHA1
SHA256
SHA512
48234a387e7777a7a284acb8f0bfef52
b34a895fe511e36af09231c1239577a565e380e6
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546
Malware Config
Extracted
| Family | remcos |
| C2 |
alukoren.duckdns.org:9144 |
Targets
Target
MD5
Filesize
48234a387e7777a7a284acb8f0bfef52.exe
48234a387e7777a7a284acb8f0bfef52
637KB
Score
10 /10
SHA1
SHA256
SHA512
b34a895fe511e36af09231c1239577a565e380e6
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546
Tags
Signatures
-
ModiLoader, DBatLoader
-
Remcos
Description
Remcos is a closed-source remote control and surveillance software.
Tags
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Adds Run key to start application
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks