modiloader | a74f312420016fc0c592337dbace24a136d17e44c009f336897f99adcb927a3f | Triage

Sharing

General

Target

a74f312420016fc0c592337dbace24a136d17e44c009f336897f99adcb927a3f
Size

34KB
MD5

4e072baabc5194a55549c60b2da9cedc
SHA1

becbdda7ba7cb0d8bfe7d306d0757269f8110734
SHA256

a74f312420016fc0c592337dbace24a136d17e44c009f336897f99adcb927a3f
SHA512

fb747c1e39f73ec370b0142b86094bb252191b3352973cf42982499d042269f99ba5a99b7d5c42fe3dd1729faff73dd04824508bd3edb11de71b94f2fe327518
SSDEEP

768:ojoiYqZOnQAK9USl9TCS0fKa0nPsQzInX+BdgbpvzYd:ojvYqZ6QAKBEf10XUOLeY

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

sample modiloader_stage2
Modiloader family
modiloader

Files

a74f312420016fc0c592337dbace24a136d17e44c009f336897f99adcb927a3f
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

StartHookOn
StopHookOff

Sections

CODE
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 95B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ