Overview

overview

10

Static

static

FCL CARDLO...03.exe

windows7-x64

10

FCL CARDLO...03.exe

windows10-2004-x64

10

Resubmissions

28-09-2022 19:48

220928-yh59paaagn 10

26-09-2022 19:38

220926-ycdbqabhb4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FCL CARDLOCK INVOICES - FORM L503.exe

  • Size

    1.0MB

  • Sample

    220928-yh59paaagn

  • MD5

    6048b7d63c1d99c4b6d1732fc6d941ae

  • SHA1

    524a1d0da58ad8bae9cf5f07a219985679013377

  • SHA256

    eddd07b69b4942f144f84ce2f03c6785b8c770a6f226c5d0f31c47bb147e7367

  • SHA512

    3bd9b413caef04df42984153b1151cd598023def6c9da9a77ddb05f90158e170314863fc40d366fbec5b0bb3b36cb72fff1be4b18be14af9d0df1fa103a6f629

  • SSDEEP

    24576:VkUwSu91iUJodQ/UbMV2i4rpNXeaqnjD:Vw9tyi4NXeaqnjD

Score
10/10
modiloadernetwirebotnetpersistenceratstealertrojan

Malware Config

Targets

    • Target

      FCL CARDLOCK INVOICES - FORM L503.exe

    • Size

      1.0MB

    • MD5

      6048b7d63c1d99c4b6d1732fc6d941ae

    • SHA1

      524a1d0da58ad8bae9cf5f07a219985679013377

    • SHA256

      eddd07b69b4942f144f84ce2f03c6785b8c770a6f226c5d0f31c47bb147e7367

    • SHA512

      3bd9b413caef04df42984153b1151cd598023def6c9da9a77ddb05f90158e170314863fc40d366fbec5b0bb3b36cb72fff1be4b18be14af9d0df1fa103a6f629

    • SSDEEP

      24576:VkUwSu91iUJodQ/UbMV2i4rpNXeaqnjD:Vw9tyi4NXeaqnjD

    Score
    10/10
    modiloadertrojannetwirebotnetpersistenceratstealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks