General
-
Target
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
Size
205KB
-
Sample
220802-brfztsefaj
-
MD5
046a622e41c6d93a98a3478834bbe0b2
-
SHA1
1eb4e567adcb63e318057de1a07a6e5df22db0f7
-
SHA256
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
SHA512
c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
Behavioral task
behavioral1
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win10v2004-20220721-en
Malware Config
Targets
-
-
Target
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
Size
205KB
-
MD5
046a622e41c6d93a98a3478834bbe0b2
-
SHA1
1eb4e567adcb63e318057de1a07a6e5df22db0f7
-
SHA256
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
SHA512
c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-