General
-
Target
48234a387e7777a7a284acb8f0bfef52.exe
-
Size
637KB
-
Sample
210408-x16bed3gjn
-
MD5
48234a387e7777a7a284acb8f0bfef52
-
SHA1
b34a895fe511e36af09231c1239577a565e380e6
-
SHA256
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
-
SHA512
e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546
Static task
static1
Behavioral task
behavioral1
Sample
48234a387e7777a7a284acb8f0bfef52.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
48234a387e7777a7a284acb8f0bfef52.exe
Resource
win10v20201028
Malware Config
Extracted
remcos
alukoren.duckdns.org:9144
Targets
-
-
Target
48234a387e7777a7a284acb8f0bfef52.exe
-
Size
637KB
-
MD5
48234a387e7777a7a284acb8f0bfef52
-
SHA1
b34a895fe511e36af09231c1239577a565e380e6
-
SHA256
4a7f380de68e6969bcedffe6c7d5b01ac9ecd1f4df9f2bb79fb7fec94252e095
-
SHA512
e3f7fefb4ba37baeea23603a9a4c48197efb54495741d613f8eddc58074f8cbe20658406c949fff510730eed8dc000cd61550b7b69e2c668cc43f6b2cb60e546
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Adds Run key to start application
-