General
-
Target
RFQ_0029388827772_Square General Contracting.exe
-
Size
838KB
-
Sample
220808-j3b41sfggj
-
MD5
3b72bfebf7e023618dae4a3703322c31
-
SHA1
3c75ed7a5fdee7d8e6025a221d64b12cb2ab9ab0
-
SHA256
868e3a9f49c41cd1823e765cc8d2e97453ada6baac959e58187e1a337db01b96
-
SHA512
032800a14f2480202a6131ed462b51af6aab17cbc0f0f7b782dc2e7d4eb27d9fc7c3a6a1b592a52c189a8d6875de4dcd2aa91abbe3af5fe7b1c32dc5748e0f4b
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_0029388827772_Square General Contracting.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
RFQ_0029388827772_Square General Contracting.exe
Resource
win10v2004-20220721-en
Malware Config
Targets
-
-
Target
RFQ_0029388827772_Square General Contracting.exe
-
Size
838KB
-
MD5
3b72bfebf7e023618dae4a3703322c31
-
SHA1
3c75ed7a5fdee7d8e6025a221d64b12cb2ab9ab0
-
SHA256
868e3a9f49c41cd1823e765cc8d2e97453ada6baac959e58187e1a337db01b96
-
SHA512
032800a14f2480202a6131ed462b51af6aab17cbc0f0f7b782dc2e7d4eb27d9fc7c3a6a1b592a52c189a8d6875de4dcd2aa91abbe3af5fe7b1c32dc5748e0f4b
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-