General
-
Target
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d
-
Size
308KB
-
Sample
220801-tz5l9secfp
-
MD5
87534619e2809e18c55656c684bed4e7
-
SHA1
16645d7ec3a62b367593ab6cffedfcad2d33d3e7
-
SHA256
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d
-
SHA512
b28e56f46e27dcddf524f1b739a98802dedfd688bb9842d35d0273618359c7f16530987f19a30fcf2b0c53e7c40d24655eff1f8874d767d674df0ce590204b3a
Static task
static1
Behavioral task
behavioral1
Sample
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d.exe
Resource
win10v2004-20220722-en
Malware Config
Targets
-
-
Target
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d
-
Size
308KB
-
MD5
87534619e2809e18c55656c684bed4e7
-
SHA1
16645d7ec3a62b367593ab6cffedfcad2d33d3e7
-
SHA256
5bd7dc1bba53ff572171a5355949bf5239cbd73f743280eb90b7c2f0542d8f3d
-
SHA512
b28e56f46e27dcddf524f1b739a98802dedfd688bb9842d35d0273618359c7f16530987f19a30fcf2b0c53e7c40d24655eff1f8874d767d674df0ce590204b3a
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-