Overview

overview

10

Static

static

DHL_988121.exe

windows7_x64

10

DHL_988121.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL_988121.exe

  • Size

    712KB

  • Sample

    210510-f1jqzbkctx

  • MD5

    da9cf01565ca4a3abbe4630656fadd23

  • SHA1

    781194da5ae0e04e02ba0c270483fac9d1c6b431

  • SHA256

    29369c122e942e2ca2747a55895c0d0439acfc372f5b698b250bb6af7fc90914

  • SHA512

    eeeec69db00809b9fa372a3fb9a185e6cefc0a945cb0b0c1f1f99fc36c971f8b28ea28bf617cea5637b60a4def94610e8a5aa6ad0ae41e2c7c6cfbdea3b5b818

Score
10/10
modiloaderparallaxpersistencerattrojan

Malware Config

Targets

    • Target

      DHL_988121.exe

    • Size

      712KB

    • MD5

      da9cf01565ca4a3abbe4630656fadd23

    • SHA1

      781194da5ae0e04e02ba0c270483fac9d1c6b431

    • SHA256

      29369c122e942e2ca2747a55895c0d0439acfc372f5b698b250bb6af7fc90914

    • SHA512

      eeeec69db00809b9fa372a3fb9a185e6cefc0a945cb0b0c1f1f99fc36c971f8b28ea28bf617cea5637b60a4def94610e8a5aa6ad0ae41e2c7c6cfbdea3b5b818

    Score
    10/10
    parallaxpersistenceratmodiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks