modiloader | f833c4ce30634739f51b5ffbdaaae479b90f2d5787f0030f46e407ccbd41ae51 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f833c4ce30634739f51b5ffbdaaae479b90f2d5787f0030f46e407ccbd41ae51
Size

276KB
MD5

0cb0030cf207a0aa8e9aacffdfecf4b5
SHA1

11a060a5f8764e3a5214a9bf67759964970d8cbf
SHA256

f833c4ce30634739f51b5ffbdaaae479b90f2d5787f0030f46e407ccbd41ae51
SHA512

88af8708cc0739685b123a49d90079b5e3f3a3538c6119e468e38b553ef2d073fabd794ecd577eb927f06b5ee60537e84c238d23b74b07c2344961f70bb9cc3d
SSDEEP

6144:qjEHiMA/QoNSWiwassZFbuPZYHNv/5rH4+af2rJpT/YSnNBzR:VHiMUsqascFQqtv/V4NfkJpT/Lv

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Files

f833c4ce30634739f51b5ffbdaaae479b90f2d5787f0030f46e407ccbd41ae51
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ