General
-
Target
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84
-
Size
492KB
-
Sample
221004-hqlbgsgeb5
-
MD5
2c8fbfc7622704265bf3e9cbd6cc0715
-
SHA1
9246c4481c1fa24c6cd5ed8c8b4028f6fcbb2ee7
-
SHA256
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84
-
SHA512
2f268b2d56a85a00fd45d4aa0ef65343b366099cbf972310e6331d755335229ae7720122d5bfdedc53cd2ef24447de336ac7ada7fb6de3ba3c4062c248490613
-
SSDEEP
12288:MjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:MsUNl6yD2KXYWzj3rZQFz
Static task
static1
Behavioral task
behavioral1
Sample
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84
-
Size
492KB
-
MD5
2c8fbfc7622704265bf3e9cbd6cc0715
-
SHA1
9246c4481c1fa24c6cd5ed8c8b4028f6fcbb2ee7
-
SHA256
e429557677252ba2ae3652a81227b6e93eb244cba9f959aaf24d17992281cb84
-
SHA512
2f268b2d56a85a00fd45d4aa0ef65343b366099cbf972310e6331d755335229ae7720122d5bfdedc53cd2ef24447de336ac7ada7fb6de3ba3c4062c248490613
-
SSDEEP
12288:MjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:MsUNl6yD2KXYWzj3rZQFz
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-