General
- Target a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
- Size 276KB
- Sample221010-raznlsccaq
- SHA256 a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee11f627e3bde36a7bfd3
Score
10/10
Malware Config
Targets
-
- Target a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee.exe
- Size 276KB
- SHA256 a6fc491d6d097332f35d3ffaa4a31ecafd1b114cdccee11f627e3bde36a7bfd3
Score10/10-
Detects Smokeloader packer
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
ModiLoader Second Stage
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext