Behavioral task
behavioral1
Sample
0745a0f64dfb16d50f30dc0f78ee32ce2e4b45eb808953a360f3c7f63e64e0bd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0745a0f64dfb16d50f30dc0f78ee32ce2e4b45eb808953a360f3c7f63e64e0bd.exe
Resource
win10v2004-20220812-en
General
-
Target
0745a0f64dfb16d50f30dc0f78ee32ce2e4b45eb808953a360f3c7f63e64e0bd
-
Size
280KB
-
MD5
43aee386d7140d826569501b7d09ca8e
-
SHA1
498f34b6b753b48f7c3276b1a0d55aee053a329a
-
SHA256
0745a0f64dfb16d50f30dc0f78ee32ce2e4b45eb808953a360f3c7f63e64e0bd
-
SHA512
4d181cf7e55b93c95cc2a32a01266ce0ea7f96ad9e4747e689539a2ec0764d4cde5d9f000531ee0e8377e576242e8fbb9ee10bdcb882f5302a169982ab87fdd4
-
SSDEEP
6144:GG377xS2Vp2CeiorXdwTBgWx4/A9V53oipcCJJvHh:lr7xS2Vp6RwTyCmA9DbJJvHh
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule sample modiloader_stage2 -
Modiloader family
Files
-
0745a0f64dfb16d50f30dc0f78ee32ce2e4b45eb808953a360f3c7f63e64e0bd.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 10KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ