Overview

overview

10

Static

static

c9791ebf65...5f.exe

windows7-x64

10

c9791ebf65...5f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c9791ebf6583c6da943487e6f20b27022a6fd83dbb2b77a676dc53ded9a00d5f

  • Size

    375KB

  • Sample

    221001-3cexrschfk

  • MD5

    530f2ee4cf4c3251c35c012d94641fe0

  • SHA1

    a780f6a81b5747efc3fe0d27b19f663ee09d368d

  • SHA256

    c9791ebf6583c6da943487e6f20b27022a6fd83dbb2b77a676dc53ded9a00d5f

  • SHA512

    66089cad2a1c97b098e1f67d3d05a7876e1c789123b083e898c3cdc6e8018be4a4aa67ae60f946a6fc783bfde9514a5ecd05bdc55f9fac599d6ed504cf630804

  • SSDEEP

    6144:94L7ulgSVrVyTR8D9TCA5z2uGw2xPk60Ddig5VaC4IGR8L6IgpgtxW:OPulgSVrhstoZKpOL6ISgt4

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      c9791ebf6583c6da943487e6f20b27022a6fd83dbb2b77a676dc53ded9a00d5f

    • Size

      375KB

    • MD5

      530f2ee4cf4c3251c35c012d94641fe0

    • SHA1

      a780f6a81b5747efc3fe0d27b19f663ee09d368d

    • SHA256

      c9791ebf6583c6da943487e6f20b27022a6fd83dbb2b77a676dc53ded9a00d5f

    • SHA512

      66089cad2a1c97b098e1f67d3d05a7876e1c789123b083e898c3cdc6e8018be4a4aa67ae60f946a6fc783bfde9514a5ecd05bdc55f9fac599d6ed504cf630804

    • SSDEEP

      6144:94L7ulgSVrVyTR8D9TCA5z2uGw2xPk60Ddig5VaC4IGR8L6IgpgtxW:OPulgSVrhstoZKpOL6ISgt4

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks