General
-
Target
d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303
-
Size
967KB
-
Sample
211206-xyfhjahha6
-
MD5
d55a0b188884ef45eeef7dda636a6b62
-
SHA1
cb7d509630dc72b29df21b17331a6db91989e65f
-
SHA256
d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303
-
SHA512
ec1f489936b45faf27e761cb15efa3f11ea11c7d526a42ac831a7431ca0898f8975643ce7c60e1ddd8ccbe6f55a4c13c7630368284de39084eb6737c415ab7a1
Static task
static1
Behavioral task
behavioral1
Sample
d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe
Resource
win10-en-20211014
Malware Config
Targets
-
-
Target
d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303
-
Size
967KB
-
MD5
d55a0b188884ef45eeef7dda636a6b62
-
SHA1
cb7d509630dc72b29df21b17331a6db91989e65f
-
SHA256
d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303
-
SHA512
ec1f489936b45faf27e761cb15efa3f11ea11c7d526a42ac831a7431ca0898f8975643ce7c60e1ddd8ccbe6f55a4c13c7630368284de39084eb6737c415ab7a1
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage
-
Executes dropped EXE
-
Drops startup file
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-